generated: '2026-08-23'
method: searched
source: >-
  openapi/kortext-labs-api-openapi.json (securitySchemes + per-operation security), Kortext's own
  published front-end runtime configuration at https://vle.kortext.com/assets/config.json, and
  live unauthenticated probes of https://app.kortext.com/account/token, https://vle.kortext.com and
  https://api-demo.labs.kortext.com, 2026-08-23.
summary:
  types:
  - http
  self_serve: false
  public_api_keys: false
  note: >-
    Kortext has NO public authentication documentation — no developer portal, no auth guide, no
    key-issuance page. Everything below is read from the one published contract and from observed
    runtime behaviour. Credentials are institutional: an account is provisioned through a
    university or publisher agreement, not through a signup form.
schemes:
- name: HTTPBearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  sources:
  - openapi/kortext-labs-api-openapi.json
  applied_to: 55 of 67 operations (per-operation; no root-level security block)
  unsecured_operations:
  - liveness_health_live_get
  - readiness_health_ready_get
  - chat_all_system_message_chat_v1_all_system_message_get
  - user_shelf_system_message_chat_v1_user_shelf_system_message_get
  - hello_chat_v1_test_hello_get
  failure_response:
    status: 403
    body: '{"detail":"Not authenticated"}'
    observed_at: https://api-demo.labs.kortext.com/podcast/v1/podcasts
    note: >-
      Uses 403 where 401 is conventional. An agent branching on 401 to trigger a token refresh will
      not fire on this API.
token_issuance:
  endpoint: https://app.kortext.com/account/token
  status_unauthenticated: 401
  source: https://vle.kortext.com/assets/config.json (field authTokenApiUrl)
  grant_documented: false
  note: >-
    The token endpoint is named in Kortext's own published runtime configuration but the grant
    type, credential format and token lifetime are not documented anywhere public.
institutional_authentication:
  mechanism: 1EdTech LTI launch
  note: >-
    For institutional users the real front door is not an API credential at all — it is an LTI 1.1
    or LTI 1.3 launch from the university's VLE, which carries identity from the institution into
    Kortext. LTI 1.3 is built on an OIDC third-party-initiated login, so an OIDC flow is
    implemented behind these endpoints even though no discovery document is served.
  endpoints:
    lti_1_1_launch: https://vle.kortext.com/api/v1/lti/v1.1/launch
    lti_1_3_deep_link_request: https://vle.kortext.com/api/v1/lti/v1.3/deep-link-request
    jwks: https://lti.dev.kortext.com/jwks
  jwks_observed:
    url: https://lti.dev.kortext.com/jwks
    status: 200
    body: '{"keys":[]}'
    note: >-
      A JWKS keyset endpoint is deployed on the LTI dev host but is empty; no production keyset is
      served on a discoverable path.
  cross_ref: conformance/kortext-conformance.yml
not_supported:
  oauth2: >-
    No oauth2 securityScheme, no authorization or token metadata document. See scopes/ — none
    written, because there is no scope surface to derive.
  openIdConnect: No openIdConnect scheme declared and no /.well-known/openid-configuration served.
  apiKey: No apiKey scheme declared on any operation.
  mutualTLS: Not declared.
  oauth_discovery:
  - url: https://api-demo.labs.kortext.com/.well-known/oauth-authorization-server
    status: 404
  - url: https://api-demo.labs.kortext.com/.well-known/openid-configuration
    status: 404
  - url: https://kortext.com/.well-known/openid-configuration
    status: 301
    note: Redirects to the marketing homepage — a soft-404, not a document.
gaps:
- No published authentication documentation of any kind.
- No token lifetime, refresh mechanism, or revocation path documented.
- No scopes or permission model — the bearer token is all-or-nothing across 55 operations.
- 403 used in place of 401, which breaks conventional client retry logic.