Authentication

Cortex uses JWT (JSON Web Tokens) for API authentication and GitHub OAuth for the web dashboard.

Web Dashboard

The frontend uses NextAuth.js  with GitHub as the OAuth provider. When you sign in:

1. You’re redirected to GitHub for authorization
2. GitHub returns an OAuth token
3. NextAuth creates a session and JWT
4. The JWT is sent to the backend with every API request

No passwords are stored. Your GitHub identity is your Cortex identity.

API Authentication

All authenticated endpoints require a Bearer token in the Authorization header:

curl -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  https://api.cortex-app.dev/api/workspace/notes

Getting a Token

Public Endpoints

These endpoints require no authentication:

Authenticated Endpoints

These endpoints require a valid JWT:

Rate Limits

Rate limits are determined by your pricing tier: