API Keys

Create and manage API keys for SDK and API access

The API Keys page lets you create and manage keys used to authenticate with the Cloud SDK, the REST API, and agent connections.

Create a key

1. Open the create modal

   Click Create new key. A modal opens with a name input (placeholder e.g. Production, CI/CD, Local Dev…).

2. Name and create the key

   Enter a name and confirm. This calls POST /api-keys with {name}.

3. Copy the key

   The new key is shown in full exactly once. Copy it immediately — afterwards only a masked label is displayed.

In cloud mode, the base URL shows your tenant URL once provisioned, or a warming up… badge while provisioning.

In local (open-source) mode, you set the LLM API key that Cognee uses to build your knowledge graph directly from the Overview page: a banner and modal let you paste the key and apply it to the running backend without editing .env.

Connection Details

The Connection Details card surfaces the values your clients need, each copyable:

Field	Description
API Base URL	Your tenant URL, e.g. https://your-tenant.aws.cognee.ai
Tenant ID	Your tenant identifier
User ID	Your user identifier, from GET /api-keys/my-user-id

It also shows an auth-header hint: X-Api-Key: <your-api-key> • X-Tenant-Id: <tenant>. Both the X-Api-Key and X-Tenant-Id headers are used by API clients and MCP.

Manage keys

The page lists all active keys with their creation date (GET /api-keys). To revoke a key, click the delete icon next to it (DELETE /api-keys/{id}). Revoked keys stop working immediately.

Every key also records a creation time and a last-used time server-side. The last-used timestamp is refreshed when the key successfully authenticates a request, throttled to at most one write every five minutes, so a busy key’s “last seen” can lag by a few minutes. Recording it never blocks authentication: if the write fails, the request still succeeds.

Plugin-provisioned keys

Keys for a per-plugin agent identity are not created from the Create new key modal. They are minted by POST /api/v1/integrations/plugins/{plugin_key}/provision, named after the plugin key (claude-code, codex, …), and belong to the plugin’s agent sub-user rather than to you — so they are listed under that agent, not on this page.

They follow the same show-once rule as keys created here: the provision response is the only place the full key appears. Calling provision again rotates the key and revokes the plugin agent’s earlier keys, and disconnecting the plugin (DELETE /api/v1/integrations/plugins/{plugin_key}) revokes all of them.

API reference

Two reference links are available on the page:

• API Reference — the shared Swagger docs at api.aws.cognee.ai/docs.
• API Tenant Reference — your tenant instance docs at https://your-tenant.aws.cognee.ai/docs.

Store API keys in environment variables or a secrets manager. Do not hardcode them in source files.

Usage

Pass the API key in requests:

Python SDK:

import cognee

await cognee.serve(
    url="https://your-tenant.aws.cognee.ai",
    api_key="your-key"
)

REST API:

curl -H "X-Api-Key: your-key" https://your-tenant.aws.cognee.ai/api/v1/datasets/

See Cloud SDK for the full setup guide.