# Cognition authentication

Agents call Cognition with a personal API key. There is no OAuth authorization-code exchange and no dynamic client registration.

## Scopes

A key carries one or both of these scopes:

- `read` — load pedagogy, skills, and dashboard reads
- `write` — save skills and report outcomes

## Get a key

1. A person opens https://www.lamlab.ai/start and signs in at https://www.lamlab.ai/sign-in.
2. The browser session calls `POST https://www.lamlab.ai/api/start/mint-key`.
3. The response includes a `cog_` key. Store it as a secret. Do not put it in a URL.

`GET https://www.lamlab.ai/api/start/mint-key` returns JSON explaining the POST. It does not issue a key.

## Call the product

```bash
curl -sS https://www.lamlab.ai/mcp \
  -H "Authorization: Bearer cog_..." \
  -H "content-type: application/json" \
  -H "accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

A missing key returns HTTP 401 JSON and a `WWW-Authenticate` header pointing at https://www.lamlab.ai/.well-known/oauth-protected-resource.

## Docs, no key

`POST https://www.lamlab.ai/mcp/docs` answers documentation questions with no key. `GET https://www.lamlab.ai/mcp/docs` describes that server.

## Install from a shell

Replace `cog_me_xxx` in the command for your host with your own key minted at https://www.lamlab.ai/start. Keep the key private.

```bash
# cursor
curl -fsSL https://www.lamlab.ai/api/install/cursor | COGNITION_KEY=cog_me_xxx bash
# claude
curl -fsSL https://www.lamlab.ai/api/install | COGNITION_KEY=cog_me_xxx bash
# codex
curl -fsSL https://www.lamlab.ai/api/install/codex | COGNITION_KEY=cog_me_xxx bash
# gemini
curl -fsSL https://www.lamlab.ai/api/install/gemini | COGNITION_KEY=cog_me_xxx bash
```

Contract: https://www.lamlab.ai/openapi.json
Developer path: https://www.lamlab.ai/developers/agents