Getting Started

API Keys

API Keys are the simplest way to authenticate server-to-server requests. They're validated against Firestore and cached in memory for 10 minutes per key.

Generate a key

API Keys are generated using a Firebase ID Token (one-time setup, typically done via the dashboard):

HTTP

POST /apikeys/generate-api-key
Authorization: Bearer <firebase-id-token>

// Response
{
  "apiKey": "sk_live_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "createdAt": "2026-01-15T10:30:00Z",
  "userId": "uid_abc123"
}

Using the key

Pass the key in the x-api-key header on every request to /chat-apiKeyAuth/* endpoints:

Shell

// Use in any chat or API endpoint:
curl -X POST https://api.cognitiondesk.com/chat-apiKeyAuth/chat \
  -H "x-api-key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"message": "Hello", "assistantId": "asst_abc123"}'

Best practices

Store keys in environment variables — never in code or version control
Use server-side code only — never expose keys to the browser
Rotate keys if you suspect they've been compromised
Use one key per integration environment (dev, staging, prod)

.env

Shell

# .env
COGNITIONDESK_API_KEY=sk_live_...
COGNITIONDESK_ASSISTANT_ID=asst_abc123

Security warning

API Keys grant full access to all Chat endpoints for the associated user account. Treat them with the same care as passwords. Do not include them in client-side JavaScript bundles or public repositories.