Skip to main content
The API Keys page lets you create and manage keys used to authenticate with the Cloud SDK, the REST API, and agent connections.

​
Create a key

1

Open the create modal

Click Create new key. A modal opens with a name input (placeholder e.g. Production, CI/CD, Local Dev…).
2

Name and create the key

Enter a name and confirm. This calls POST /api-keys with {name}.
3

Copy the key

The new key is shown in full exactly once. Copy it immediately — afterwards only a masked label is displayed.
If the workspace has no active subscription, a banner sits at the top of the page — No active subscription / Subscribe to unlock data uploads, search, and all features. — with an Upgrade button that opens the plan chooser. The same banner appears on Search.In cloud mode, the base URL shows your tenant URL once provisioned; while the workspace is still provisioning the field shows a loading placeholder and the copy button is hidden.

​
Connection Details

The Connection Details card surfaces the values your clients need, each copyable: It also shows an auth-header hint: X-Api-Key: <your-api-key> • X-Tenant-Id: <tenant>. Both the X-Api-Key and X-Tenant-Id headers are used by API clients and MCP.

​
Manage keys

The page lists all active keys with their creation date (GET /api-keys). To revoke a key, click the delete icon next to it (DELETE /api-keys/{id}). Revoked keys stop working immediately. Every key also records a creation time and a last-used time server-side. The last-used timestamp is refreshed when the key successfully authenticates a request, throttled to at most one write every five minutes, so a busy key’s “last seen” can lag by a few minutes. Recording it never blocks authentication: if the write fails, the request still succeeds.

​
Plugin-provisioned keys

Keys for a per-plugin agent identity are not created from the Create new key modal. They are minted by POST /api/v1/integrations/plugins/{plugin_key}/provision, named after the plugin key (claude-code, codex, …), and belong to the plugin’s agent sub-user rather than to you — so they are listed under that agent, not on this page. They follow the same show-once rule as keys created here: the provision response is the only place the full key appears. Calling provision again rotates the key and revokes the plugin agent’s earlier keys, and disconnecting the plugin (DELETE /api/v1/integrations/plugins/{plugin_key}) revokes all of them.

​
API reference

Two reference links are available on the page:
  • API Reference — the shared Swagger docs at api.aws.cognee.ai/docs.
  • API Tenant Reference — your tenant instance docs at https://your-tenant.aws.cognee.ai/docs.
Store API keys in environment variables or a secrets manager. Do not hardcode them in source files.

​
Usage

Pass the API key in requests: Python SDK:
REST API:
See Cloud SDK for the full setup guide.