Skip to main content
The Cognizo REST API authenticates with API keys: create a key in the dashboard and send it as a header on every request. There is no OAuth flow for the REST API.
The MCP server also accepts a browser sign-in for Claude’s web, desktop, mobile and Cowork clients, so those need no key at all. Every other client — including Claude Code — uses the API key described here. See Connect a client.

​
The header

Requests without a valid key get 401 UNAUTHORIZED; a valid key that tries to reach an endpoint outside the public API surface gets 403 FORBIDDEN.

​
Creating a key

  1. Open app.cognizo.ai/api-keys.
  2. Create key, give it a name (e.g. production, zapier, local), and optionally an expiry date.
  3. Copy the secret — it starts with cog_sk_ and is shown only once.
A key belongs to the user who created it but is scoped to your organization: it can read and write every brand your org owns, exactly like signing in to the app.
Don’t see API Keys in the sidebar? The feature is enabled per organization. If the page says “API keys aren’t enabled for this organization”, get in touch and we’ll turn it on.

​
Key anatomy

Only a SHA-256 digest of the key is stored, so nobody — including us — can recover the plaintext after creation. The dashboard shows the first few characters and the last four so you can tell keys apart.

​
Expiry, rotation, revocation

  • A key can carry an expiry date. After it passes, the key stops authenticating and requests fail with 401 — no grace period.
  • Rotating: create the new key, switch your integration to it, then revoke the old one. Both work in parallel until you do.
  • Revoking is immediate. The next request with that key gets 401, including requests already queued in your own retry loop.
  • Hold one key per integration. It keeps rotation cheap and shrinks the blast radius when something leaks.
Treat an API key like a password. Anyone holding it can act as your entire organization. Never commit keys to source control or paste them into a browser console; keep them in a secret manager or a server-side env var.

​
Scope

An API key has full read + write access to the public API surface — the endpoints listed in the API Reference — and nothing else. Every other endpoint the platform runs (internal tooling, billing, content generation, admin) rejects API keys outright with 403, even for the org that owns the key. Within that surface the key sees exactly what a signed-in member of your org sees: your brands and the data attached to them, never another org’s.

​
Using a key with the MCP server

The MCP server takes the same key in the same header and forwards it upstream per request — it stores nothing. That’s how Claude Code, Cursor, VS Code, Windsurf and ChatGPT connect. Claude’s web, desktop, mobile and Cowork clients can’t send a custom header, so they sign in instead: add Cognizo from Claude’s connector directory, authorize once in the browser, and pick which organization the connector reads. No key is created or pasted, and you can disconnect it from Claude at any time. Both routes land on the same tools with the same permissions. See Connect a client for each, and Security & troubleshooting for how each credential is handled.