> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oncortex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Service credentials

> Keys for scripts and automations that cannot sign in through a browser

Most connections sign in through your browser: you approve, and the agent gets a key. But some things have no human to click approve, a scheduled script, a server-to-server integration, a CI job. For those, Cortex issues a **service credential**: a key you create yourself and paste into the automation.

A service credential is deliberately narrower than an interactive connection: it belongs to one brain and carries one fixed access level, because an unattended script should hold the least it needs. It just skips the browser step.

## Creating one

<Steps>
  <Step title="Open the brain's credentials page">
    From the brain's **Connect** page, follow the link for automation ("Automation without a human?") to its service credentials, or go to the brain's settings and find Service credentials.
  </Step>

  <Step title="Issue a credential">
    Give it a label you will recognise later (for example "nightly import"), choose its access level (read, or read and write), and create it. Cortex shows you the key, which starts with `ck_`, once. Copy it now; you will not be shown it again.
  </Step>

  <Step title="Use it">
    Send the key as a bearer token in the `Authorization` header of your requests to the Cortex API. For example, pushing a note into the brain's inbox:

    ```bash theme={null}
    curl https://api.oncortex.ai/api/v1/inbox \
      -H "Authorization: Bearer ck_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{"filename": "nightly.md", "content": "...", "externalId": "run-2026-07-08"}'
    ```
  </Step>
</Steps>

## Keeping it safe

* A service credential is a password. Store it in your automation's secret store, never in code you commit or share.
* It only reaches its one brain, at its one access level. A read-only credential cannot write, and no credential can reach a different brain.
* Revoke it any time from the same credentials page. Revoking takes effect immediately, and you can issue a fresh one if you need to rotate.
* Everything a credential writes is recorded against the credential, by its id and the label you gave it, in the brain's audit trail on the Health page. Give each automation its own credential with a clear label ("granola collector", "nightly CRM pull") so the trail answers "which agent did this" without guesswork.

## When to use OAuth instead

If a human is present and the tool has a browser, use the normal [connection flow](/connect/how-connections-work) rather than a service credential: it covers all your brains through one approval and follows your access live. Service credentials are specifically for the unattended case.

For the full list of things you can do with the API, see the [API reference](/reference/api).