CORE Authentication: Methods and Security Best Practices (2026)

Authentication overview

CORE, encompassing the Wolfram Language and its associated services, provides computational capabilities accessible programmatically. Authentication is a prerequisite for interacting with these services, ensuring that requests originate from authorized users or applications. The primary goal of CORE's authentication framework is to grant secure, controlled access to its extensive functions, data, and deployed resources, such as Wolfram Cloud deployments or API functions. It prevents unauthorized usage and protects user data and intellectual property associated with computations and applications built on the Wolfram platform. The specific authentication method chosen depends on the integration type: direct server-to-server communication typically uses API keys, while applications requiring user consent for access to their Wolfram resources leverage OAuth 2.0.

CORE integrates with the Wolfram ID system, which serves as a centralized identity provider for Wolfram products and services. A Wolfram ID is required to obtain credentials for API access and to manage permissions for various Wolfram Cloud resources. For comprehensive details on the Wolfram Language's programmatic capabilities, refer to the official Wolfram Language documentation.

Supported authentication methods

CORE supports several authentication methods to accommodate different integration scenarios, ranging from simple script execution to complex web applications. The choice of method impacts how credentials are managed and how authorization flows are handled.

API Key Authentication

API key authentication is suitable for server-side applications, scripts, or command-line tools that require direct, programmatic access to Wolfram Language functions or deployed APIs without requiring interactive user consent for each request. An API key is a unique token that identifies the calling application or user account. It is typically passed in a request header or as a query parameter.

• When to use: Backend services, internal tools, automated scripts, or scenarios where the application itself owns the access and no specific end-user consent is needed per interaction.
• Security considerations: API keys grant broad access; they should be treated like passwords and kept confidential. Revocation mechanisms are available for compromised keys.

OAuth 2.0

OAuth 2.0 is an authorization framework that allows third-party applications to obtain limited access to a user's resources on an HTTP service, without exposing the user's credentials. CORE uses OAuth 2.0 for applications that need to access Wolfram Cloud resources on behalf of an end-user, such as deployed forms, user data, or computational results within their Wolfram account.

• When to use: Web applications, mobile apps, or desktop software that interact with a user's Wolfram Cloud account and require explicit user permission. It is ideal for scenarios where an application needs to perform actions such as running user-defined API functions, accessing stored data, or managing cloud deployments.
• Flows supported: CORE typically supports authorization code flow for web applications and PKCE (Proof Key for Code Exchange) for public clients like mobile and desktop apps to enhance security. The Wolfram ID system acts as the OAuth provider. For a general understanding of OAuth 2.0 flows, consult the OAuth 2.0 specification.
• Security considerations: OAuth 2.0 minimizes the risk of credential exposure by providing access tokens instead of direct credentials. Proper implementation of redirect URIs and state parameters is crucial to prevent common vulnerabilities.

Table of authentication methods

Getting your credentials

Accessing CORE's authenticated services requires obtaining appropriate credentials through your Wolfram ID account. The process varies slightly depending on whether you need an API key for direct access or are setting up an application for OAuth 2.0.

Obtaining an API Key

1. Create or log in to your Wolfram ID: Navigate to the Wolfram homepage and either create a new Wolfram ID or log in to an existing one. This ID is your central account for all Wolfram services.
2. Access the Developer Portal (or equivalent): Within your Wolfram ID account, look for a section related to Developer Services, API Access, or Cloud Management. The exact path may vary but typically falls under account settings or a dedicated developer dashboard.
3. Generate a new API key: Follow the prompts to generate a new API key. You may be asked to provide a name or description for the key to help you manage multiple keys.
4. Store your API key securely: Once generated, the API key will be displayed. Copy it immediately and store it in a secure location. For security reasons, API keys are often only shown once upon generation and cannot be retrieved later.

For detailed, step-by-step instructions on managing API keys, consult the specific developer guides available within your Wolfram ID account or the Wolfram Language Cloud and Web Services documentation.

Setting up OAuth 2.0 Application

If your application requires OAuth 2.0 for user authentication, you will need to register your application with Wolfram's developer services.

1. Register your application: In the developer section of your Wolfram ID account, find an option to register a new application.
2. Provide application details: You will typically need to provide:
• Application Name: A user-friendly name for your application.
• Redirect URIs: The authorized callback URLs where users will be redirected after granting or denying access. These must be precisely configured to match your application's endpoints.
• Application Type: (e.g., Web Application, Desktop Application, Mobile Application).
3. Receive Client ID and Client Secret: Upon registration, you will be issued a Client ID and, for confidential clients (like web applications), a Client Secret. The Client ID identifies your application, and the Client Secret is used to authenticate your application with the authorization server.
4. Configure scopes: Define the specific permissions (scopes) your application needs, such as access to specific Wolfram Cloud services or user data. Users will be prompted to approve these scopes during the authorization flow.

The Wolfram Language documentation for Cloud and Web Services provides guidance on configuring OAuth-enabled applications and managing access tokens.

Authenticated request example

This example demonstrates how to make an authenticated request to a Wolfram Language API using an API key with the WolframClientForPython SDK, which simplifies interaction with Wolfram services. The WolframClientForPython library streamlines the process of sending Wolfram Language expressions to a Wolfram Engine or Wolfram Cloud instance and receiving results.

First, ensure you have the WolframClientForPython installed:

pip install wolframclient

Then, you can use your API key to authenticate requests. This example evaluates a simple Wolfram Language expression. Replace YOUR_API_KEY with your actual API key obtained from your Wolfram ID account.

from wolframclient.evaluation import WolframCloudSession
from wolframclient.language import wl

# Your Wolfram Cloud API key
api_key = "YOUR_API_KEY"

# Initialize a Wolfram Cloud session with your API key
# The 'WolframCloudSession' takes the API key for authentication.
# For a local Wolfram Engine, you might use WolframLanguageSession without an API key if it's already authenticated locally.
with WolframCloudSession(wolframcloudserver='https://www.wolframcloud.com', appid=None, appkey=api_key) as session:
    try:
        # Evaluate a simple Wolfram Language expression
        result = session.evaluate(wl.FactorInteger(123456789123456789))
        print(f"Result of FactorInteger: {result}")

        # You can also deploy functions and call them via their API endpoint
        # For example, calling a deployed API function might look like this (conceptual):
        # deployed_function_url = "https://www.wolframcloud.com/obj/your_username/api/MyApiFunction"
        # params = {'input': 10}
        # response = session.call_deployed_api(deployed_function_url, params)
        # print(f"Deployed API response: {response}")

    except Exception as e:
        print(f"An error occurred: {e}")

This Python code snippet connects to the Wolfram Cloud using the provided API key and evaluates a mathematical function. The WolframCloudSession handles the underlying HTTP requests and authentication headers, simplifying the developer experience. For more examples and advanced usage, refer to the WolframClientForPython GitHub repository.

Security best practices

Implementing security best practices is crucial when integrating with CORE's authenticated services to protect your credentials, data, and applications. Neglecting these practices can lead to unauthorized access and potential data breaches.

API Key Management

• Do not hardcode API keys: Never embed API keys directly in your source code. Use environment variables, configuration files, or secret management services (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) to store and retrieve keys securely at runtime. The Google Cloud API key best practices provide general guidance applicable to any API key usage.
• Restrict API key permissions: Generate API keys with the minimum necessary permissions required for the specific task. Over-privileged keys pose a greater risk if compromised.
• Rotate API keys regularly: Implement a schedule to rotate your API keys. This limits the exposure window if a key is compromised.
• Monitor API key usage: Keep track of API key usage patterns. Unusual spikes or requests from unexpected locations could indicate a compromise.
• Secure transmission: Always transmit API keys over HTTPS to encrypt the communication channel and prevent eavesdropping.
• Revoke unused or compromised keys: Immediately revoke any API keys that are no longer in use or are suspected of being compromised.

OAuth 2.0 Implementation

• Use secure redirect URIs: Ensure that your redirect URIs are specific and use HTTPS. Avoid using wildcards. Invalid redirect URIs are a common attack vector (e.g., redirection attacks).
• Validate state parameters: When using the authorization code grant type, include a randomly generated state parameter in the authorization request and verify it upon callback to prevent Cross-Site Request Forgery (CSRF) attacks.
• Protect Client Secrets: For confidential clients (e.g., web applications), the Client Secret must be stored securely and never exposed in client-side code.
• Implement PKCE for public clients: For mobile and desktop applications (public clients), use the Proof Key for Code Exchange (PKCE) extension to OAuth 2.0 to mitigate authorization code interception attacks.
• Handle tokens securely: Store access tokens and refresh tokens in secure, isolated storage. Avoid storing them in local storage (localStorage) in web browsers due to XSS vulnerabilities. Use HTTP-only cookies or in-memory storage.
• Enforce token expiration: Respect token expiration times and implement proper refresh token mechanisms to obtain new access tokens without re-authenticating the user.
• Validate token signatures: If your application directly processes JWTs (JSON Web Tokens) issued by the authorization server, always validate their signatures to ensure their integrity and authenticity.

General Security Practices

• Use HTTPS everywhere: All communication with CORE services, including API calls and OAuth redirects, should be encrypted using HTTPS.
• Error handling: Implement robust error handling without exposing sensitive information in error messages.
• Least privilege: Ensure that your application and the credentials it uses operate with the minimum necessary permissions.
• Regular security audits: Periodically review your authentication and authorization implementation for potential vulnerabilities.