Can I authenticate to Cognocient with JWTs from my identity provider?

Register your identity provider

Open Settings → Security & SSO → JWT authentication and add an issuer:

Cognocient reads the JWKS to confirm it holds signing keys before saving. An issuer and audience pair can belong to only one account.

Call with a token

from openai import OpenAI
 
client = OpenAI(base_url="https://api.cognocient.com/v1", api_key=get_token_from_idp())
resp = client.chat.completions.create(model="gpt-4o", messages=[{"role": "user", "content": "Hi"}])

The token goes wherever an API key would: Authorization: Bearer <jwt>. It works on every proxy endpoint, including /v1/responses, audio, rerank and the MCP gateway.

Use Verify token on the same page to paste a token and see whether it would be accepted and exactly how it would be attributed, without making a call.

Security model

• Algorithms: RS256/384/512, PS256/384/512, ES256/384/512 only. alg: none and every HMAC algorithm are refused, which closes the classic algorithm-confusion attack.
• Claims: iss must equal the registered issuer, aud the registered audience, and exp must be present. 60 seconds of clock skew is tolerated.
• Keys: fetched from the JWKS URL you registered, which must be public HTTPS (private and internal addresses are refused). An unknown kid triggers one refetch per minute, so key rotation works without letting bad tokens hammer your IdP.
• Fail closed: if the registry cannot be read, nobody is authenticated.
• Plan: if your plan drops below Business, tokens stop being accepted.

Notes

• All callers from one issuer share the issuer's rate-limit key. Per-user limits belong in your IdP or gateway.
• The verified token itself is never logged or stored.
• Deleting an issuer revokes its key immediately.