Corti · Authentication Profile

Corti Authentication

Authentication

Corti uses OAuth 2.0 client credentials (Keycloak / OpenID Connect) for server-to-server access to the Corti API. Clients exchange a client_id and client_secret at the realm token endpoint for a short-lived (5 minute) bearer access token, then call the API with an Authorization: Bearer header plus a required Tenant-Name header identifying the tenant context (default "base"). Limited-scope tokens (scope "openid transcribe" / "openid streams") can be minted for browser-side real-time streaming. The Embedded Assistant uses a separate token flow. Corti recommends client credentials over static API keys for short blast radius, scope granularity, and enterprise IdP/tenancy integration.

Corti secures its APIs with oauth2 and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and authorizationCode flow(s).

CompanyHealthHealthcareArtificial IntelligenceSpeech to TextMedical CodingClinical DocumentationAgentsMachine Learning
Methods: oauth2, openIdConnect Schemes: 2 OAuth flows: clientCredentials, authorizationCode API key in:

Security Schemes

CortiAuth oauth2
· flows: clientCredentials
BearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://docs.corti.ai/authentication/overview
docs: https://docs.corti.ai/authentication/overview
description: >-
  Corti uses OAuth 2.0 client credentials (Keycloak / OpenID Connect) for
  server-to-server access to the Corti API. Clients exchange a client_id and
  client_secret at the realm token endpoint for a short-lived (5 minute) bearer
  access token, then call the API with an Authorization: Bearer header plus a
  required Tenant-Name header identifying the tenant context (default "base").
  Limited-scope tokens (scope "openid transcribe" / "openid streams") can be
  minted for browser-side real-time streaming. The Embedded Assistant uses a
  separate token flow. Corti recommends client credentials over static API keys
  for short blast radius, scope granularity, and enterprise IdP/tenancy integration.
summary:
  types: [oauth2, openIdConnect]
  oauth2_flows: [clientCredentials, authorizationCode]
  token_ttl_seconds: 300
  required_headers: [Authorization, Tenant-Name]
  identity_provider: Keycloak (OpenID Connect)
schemes:
- name: CortiAuth
  type: oauth2
  description: OAuth 2.0 client credentials via Corti Auth (Keycloak realm)
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.eu.corti.app/realms/{tenant}/protocol/openid-connect/token
    scopes_count: 57
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth]
  sources: [docs, well-known/corti-openid-configuration.json]
- name: BearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: Short-lived JWT access token presented on each API request
  sources: [docs]
environments:
- name: eu
  auth_server: https://auth.eu.corti.app
  api_base: https://api.eu.corti.app/v2
- name: us
  auth_server: https://auth.us.corti.app
  api_base: https://api.us.corti.app/v2
- name: beta-eu
  auth_server: https://auth.beta-eu.corti.app
  api_base: https://api.beta-eu.corti.app/v2
notes:
- The Embedded Assistant authenticates differently; see https://docs.corti.ai/assistant/authentication
- Agents (A2A) MCP calls support authorizationType none/inherit; inherit reuses the caller bearer token.