cor-auth

COR Auth — Cheat Sheet

Overview

The COR MCP Server supports two authentication modes with auto-detection. The server checks env vars at startup and picks the right flow automatically.

Mode	Env Vars	Use Case
User Credentials	COR_EMAIL + COR_PASSWORD	Personal use, testing, single-user agents
Client Credentials	COR_API_KEY + COR_CLIENT_SECRET	Server-to-server, automated workflows

Priority: User Credentials (email/password) takes priority when both are set. To use Client Credentials, leave email/password unset.

---

Mode A: User Credentials (Email + Password)

Step-by-Step

1. Set environment variables:

   [email protected]
   COR_PASSWORD=your_secret_password
   COR_API_URL=https://api.projectcor.com/v1
   

2. Server detects auth mode → "Auth mode: User Credentials (email/password)"

3. On first API call, the server sends:

   POST https://api.projectcor.com/v1/auth/login
   Content-Type: application/x-www-form-urlencoded
   Accept: application/json
   
   [email protected]&password=your_secret_password
   

4. COR API responds with one of these shapes:

   // Shape 1 — direct token
   {"access_token": "eyJ...", "expires_in": 3600}
   
   // Shape 2 — nested token object
   {"token": {
       "access_token": "eyJ...",
       "type": "bearer",
       "refreshToken": "rt_...",
       "expirationTime": "1712345678000"
   }}
   
   // Shape 3 — data wrapper
   {"data": {"token": "eyJ..."}}
   

5. Token is cached in the TokenStore (thread-safe, in-memory).

6. Subsequent API calls reuse the cached token until it's within 60 seconds of expiry, then auto-refresh.

Email/Password Auth Flow Diagram

┌─────────┐         ┌──────────────┐         ┌──────────────┐
│ Hermes  │  tool   │  COR MCP     │  POST    │  COR API     │
│ Agent   │────────►│  Server      │─────────►│  /auth/login │
│         │         │              │◄─────────┤              │
│         │         │  TokenStore  │  JWT     │              │
│         │         │  cache       │          └──────────────┘
└─────────┘         └──────────────┘