Whether you're integrating with Corti's services or testing new capabilities, setting up an API key through the Corti Console is quick and secure. This guide walks you through creating a new API client and using it to authenticate your requests via the Client Credentials Flow.
Step-by-Step: Creating a New API Client in Corti Console
Log in to the Corti Console
Navigate to the API Client section
Click “+ Create API Client”
This will open a form to define your new API client.
Fill in the API Client details:
Name: Enter a meaningful name
Client ID: This is usually auto-generated based on the name, but editable.
Region: Choose the deployment region where your tenant is hosted (e.g., US Region or EU Region).
If you intend to create an API client for use with the Embedded Corti Assistant, check the 'Use with Embedded Assistant' box at the bottom of the modal.
Select the appropriate Authentication Method for your application
Auth Code (with PKCE) & Auth Code (without PKCE) will require your users to be redirected to Corti to directly authenticate with the Assistant app.
ROPC will allow you to authenticate users using usernames and passwords in a system to system workflow that will allow users to authenticate without being redirected to Corti.
Click “Create API Client.”
The system will generate a Client ID and a Client Secret. Make sure to copy the Client Secret right away — it won’t be shown again!
Use the Authentication Quickstart Panel
Click on the “🚀Authentication Quickstart” dropdown to open a prebuilt code panel. You’ll see tabs for JavaScript, Python, and .NET.
Each code snippet:
Includes your pre-filled Client Credentials, Environment and Tenant name
Hides your Client Secret but allows you to copy it (in full) to your clipboard with one click
Provides a ready-to-use OAuth token request following the Client Credentials Flow
💡Bonus: This mirrors the Postman authentication flow, so if you’ve used Postman, you’ll feel right at home.
What Happens Next?
With your access token retrieved, you can now:
Add the token to the
Authorizationheader of your API requests:http CopyEdit Authorization: Bearer <access_token>
Safely interact with Corti's APIs within the limits and scopes assigned to your API client.
Security Best Practices
Never share your Client Secret publicly or commit it to version control.
Rotate secrets periodically if supported.
Store secrets in a secure secret manager or environment variable system.