Authentication
Learn how to authenticate API requests with Cortex using JWT Bearer tokens, refresh tokens, and Two-Factor Authentication (2FA).
Authentication
The Cortex API utilizes JSON Web Tokens (JWT) for secure, stateless request authentication. All authenticated endpoints enforce Bearer authentication in the HTTP Authorization header.
Bearer Token Authentication
Include your access token in the Authorization header:
Authorization: Bearer <user_access_token>curl -X GET https://api.cortexaso.com/api/user/profile/v1 \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-H "Content-Type: application/json"Token Lifecycle
| Token Type | Purpose | Expiration | Refresh Mechanism |
|---|---|---|---|
| Access Token | Authorizes API requests to protected endpoints | 15 minutes | Handled via /user/auth/v1/refresh_token |
| Refresh Token | Rotates expired access tokens | 30 days | Stored securely in HTTP-only cookies or vault |
| Registration Token | Verifies email OTP during registration flow | 10 minutes | One-time use |
| Forgot Password Token | Authorizes password reset following OTP confirmation | 10 minutes | One-time use |
Never expose refresh tokens or long-lived credentials in client-side code repositories or public client bundles.
Two-Factor Authentication (TOTP)
Cortex supports standard RFC 6238 Time-based One-Time Passwords (TOTP) compatible with Google Authenticator, 1Password, and Apple Passwords.
- Initiate Setup: Call
POST /api/user/2fa/v1/setupto receive your setup URI and manual secret key. - Enable 2FA: Call
POST /api/user/2fa/v1/enablewith a valid 6-digit TOTP code to finalize setup and retrieve emergency recovery codes. - Verify at Login: When 2FA is active, standard login prompts for a secondary code passed to
POST /api/user/2fa/v1/verify_login.