---
updatedAt: 2026-09-10T08:06:17.000Z
agentTools:
  projectIndex: https://docs.cognism.com/llms.txt
---

# Authentication

Generate OAuth 2.0 client credentials, request an access token, and authenticate Cognism API calls.

The Cognism API uses the OAuth 2.0 **client credentials** flow. Your application exchanges a `client_id` and `client_secret` for a short-lived access token and sends that token as a bearer token on every request. No end-user sign-in is involved, which makes the flow suitable for server-to-server integrations, scheduled jobs and AI agents.

## Step 1: Generate client credentials

1. Sign in to the Cognism platform and open <Anchor target="_blank" href="https://platform.cognism.com/settings/connect-api-m2m">Settings → M2M Connect</Anchor>.
2. Generate a `client_id` and `client_secret`.
3. Store both values in a secrets manager or environment variables. The secret is shown once.

<Callout icon="⚠️" theme="warn">
  Treat the `client_secret` like a password. Never embed it in browser-side code, mobile apps or source control, and rotate it if you suspect it has been exposed.
</Callout>

## Step 2: Request an access token

Send a `POST` request to the token endpoint with your credentials and the Cognism API audience.

```bash
curl --request POST \
  --url https://cognism-production.eu.auth0.com/oauth/token \
  --header 'Content-Type: application/json' \
  --data '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "audience": "https://api.cognism.com"
  }'
```

| Parameter       | Required | Value                                       |
| :-------------- | :------- | :------------------------------------------ |
| `grant_type`    | Yes      | Always `client_credentials`.                |
| `client_id`     | Yes      | The client ID generated in M2M Connect.     |
| `client_secret` | Yes      | The client secret generated in M2M Connect. |
| `audience`      | Yes      | Always `https://api.cognism.com`.           |

A successful response returns the token and its lifetime:

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 1200,
  "token_type": "Bearer"
}
```

| Field          | Description                                                               |
| :------------- | :------------------------------------------------------------------------ |
| `access_token` | The bearer token to send on API requests.                                 |
| `expires_in`   | Lifetime in seconds. Tokens are valid for **1,200 seconds (20 minutes)**. |
| `token_type`   | Always `Bearer`.                                                          |

## Step 3: Authenticate API requests

Include the token in the `Authorization` header of every request to `https://api.cognism.com`:

```http
Authorization: Bearer YOUR_ACCESS_TOKEN
```

Requests without a valid token are rejected with `401 Unauthorized`.

## Token lifecycle best practices

* **Cache the token** and reuse it for its full lifetime. Requesting a new token for every API call is unnecessary and slows your integration down.
* **Refresh before expiry.** Track `expires_in` and request a new token a minute or so before the current one lapses, or on the first `401` you receive.
* **Retry once on&#x20;**`401`**.** If a request fails with `401` while you hold a token you believe is valid, fetch a fresh token and retry the request once. Do not loop.
* **One set of credentials per integration.** Separate credentials per application make it easier to rotate a secret or trace usage without affecting other systems.