Skip to main content
Most connections sign in through your browser: you approve, and the agent gets a key. But some things have no human to click approve, a scheduled script, a server-to-server integration, a CI job. For those, Cortex issues a service credential: a key you create yourself and paste into the automation. A service credential is deliberately narrower than an interactive connection: it belongs to one brain and carries one fixed access level, because an unattended script should hold the least it needs. It just skips the browser step.

​
Creating one

1

Open the brain's credentials page

From the brain’s Connect page, follow the link for automation (“Automation without a human?”) to its service credentials, or go to the brain’s settings and find Service credentials.
2

Issue a credential

Give it a label you will recognise later (for example “nightly import”), choose its access level (read, or read and write), and create it. Cortex shows you the key, which starts with ck_, once. Copy it now; you will not be shown it again.
3

Use it

Send the key as a bearer token in the Authorization header of your requests to the Cortex API. For example, pushing a note into the brain’s inbox:

​
Keeping it safe

  • A service credential is a password. Store it in your automation’s secret store, never in code you commit or share.
  • It only reaches its one brain, at its one access level. A read-only credential cannot write, and no credential can reach a different brain.
  • Revoke it any time from the same credentials page. Revoking takes effect immediately, and you can issue a fresh one if you need to rotate.
  • Everything a credential writes is recorded against the credential, by its id and the label you gave it, in the brain’s audit trail on the Health page. Give each automation its own credential with a clear label (“granola collector”, “nightly CRM pull”) so the trail answers “which agent did this” without guesswork.

​
When to use OAuth instead

If a human is present and the tool has a browser, use the normal connection flow rather than a service credential: it covers all your brains through one approval and follows your access live. Service credentials are specifically for the unattended case. For the full list of things you can do with the API, see the API reference.