Authentication

The Cognism API uses the OAuth 2.0 client credentials flow. Your application exchanges a client_id and client_secret for a short-lived access token and sends that token as a bearer token on every request. No end-user sign-in is involved, which makes the flow suitable for server-to-server integrations, scheduled jobs and AI agents.

Step 1: Generate client credentials

Sign in to the Cognism platform and open Settings → M2M Connect.
Generate a client_id and client_secret.
Store both values in a secrets manager or environment variables. The secret is shown once.

⚠️
Treat the client_secret like a password. Never embed it in browser-side code, mobile apps or source control, and rotate it if you suspect it has been exposed.

Step 2: Request an access token

Send a POST request to the token endpoint with your credentials and the Cognism API audience.

curl --request POST \
  --url https://cognism-production.eu.auth0.com/oauth/token \
  --header 'Content-Type: application/json' \
  --data '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "audience": "https://api.cognism.com"
  }'

Parameter	Required	Value
`grant_type`	Yes	Always `client_credentials`.
`client_id`	Yes	The client ID generated in M2M Connect.
`client_secret`	Yes	The client secret generated in M2M Connect.
`audience`	Yes	Always `https://api.cognism.com`.

A successful response returns the token and its lifetime:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 1200,
  "token_type": "Bearer"
}

Field	Description
`access_token`	The bearer token to send on API requests.
`expires_in`	Lifetime in seconds. Tokens are valid for 1,200 seconds (20 minutes).
`token_type`	Always `Bearer`.

Step 3: Authenticate API requests

Include the token in the Authorization header of every request to https://api.cognism.com:

Authorization: Bearer YOUR_ACCESS_TOKEN

Requests without a valid token are rejected with 401 Unauthorized.

Token lifecycle best practices

Cache the token and reuse it for its full lifetime. Requesting a new token for every API call is unnecessary and slows your integration down.
Refresh before expiry. Track expires_in and request a new token a minute or so before the current one lapses, or on the first 401 you receive.
Retry once on 401. If a request fails with 401 while you hold a token you believe is valid, fetch a fresh token and retry the request once. Do not loop.
One set of credentials per integration. Separate credentials per application make it easier to rotate a secret or trace usage without affecting other systems.