> ## Documentation Index > Fetch the complete documentation index at: https://docs-classic.cognigy.com/llms.txt > Use this file to discover all available pages before exploring further. # Copilot Section > Learn how to configure the Copilot section in Endpoint settings to integrate Agent Copilot with a contact center platform. [Updated in 2026.21](https://docs-classic.cognigy.com/release-notes/2026.21.md) The **Copilot** section in the [Endpoint settings](https://docs-classic.cognigy.com/ai/agents/deploy/endpoints/overview) is used to configure the Agent Copilot workspace. The following Endpoints include the **Copilot** section: * [NiCE CXone Agent Assist Hub (AAH)](https://docs-classic.cognigy.com/agent-copilot/deploy/nice-aah.md) * [LINE](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/line-messenger.md) * [Facebook (Meta) Messenger](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/facebook-messenger.md) * [8x8](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/8x8.md) * [Voice Gateway](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/voice-gateway.md) * [Slack](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/slack.md) * [Sunshine Conversations](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/sunshine-conversations.md) * [Socket.IO](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/socketio.md) * [Azure Bot Services](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/azure-bot-services.md) * [Genesys](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/genesys.md) * [Webhook](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/webhook.md) * [Webchat v3](https://docs-classic.cognigy.com/webchat/v3/configuration.md) ## Prerequisites * If you use **Token Secret** authentication, you need a 256-bit string secret for signing. ## Limitations * Cognigy caches JWKS responses for up to 5 key store URLs at once. If an additional URL is used, the new URL replaces the oldest one in the cache. * Cognigy sends up to 10 requests/minute to any single JWKS URL. ## Restrictions * EdDSA (Ed25519/Ed448) keys aren't supported for **Public Key** or **Key Store** authentication. ## Parameters | Parameter | Type | Description | | - | - | - | | Copilot Type | List | Activates and sets how to configure Agent Copilot. Select one of the following options: | | Copilot Flow | List | Sets the Flow in which the Agent Copilot workspace or the Agent Copilot Whisper is configured. | | Copilot Config | List | Sets the configuration for the Agent Copilot workspace. Valid for workspaces configured via [API](https://docs-classic.cognigy.com/api-reference/agent-copilot-configurations/get-agent-copilot-configurations.md). | | Authentication | List | Sets the method to verify the JWT passed in the Agent Copilot URL. Enforce the method by activating **Accept Only JWT Requests**. Select one of the following methods:For more information, see [JWT Authentication Methods](#jwt-authentication-methods). | | Agent Copilot Authentication | List | This parameter appears only when **Token Secret** is selected in **Authentication**. Defines the JWT connection to use for symmetric authentication. Select a JWT connection or create one by clicking ![add JWT connection](https://mintcdn.com/cognigy-docs-legacy/eGdkyf6N-EPpPKZA/_assets/icons/black-and-white/plus-sign.svg?fit=max\&auto=format\&n=eGdkyf6N-EPpPKZA\&q=85\&s=6c618ceec3b83f76b1793e171bd4e8a2) and configuring the connection: | | Public Keys | Text | This parameter appears only when **Public Key** is selected in **Authentication**. Defines one or more PEM-encoded public keys. A token is accepted if it verifies with any of the configured public keys. Use multiple keys to support key rotation. Remove a key to immediately invalidate tokens signed with it. | | Key Store URL | Text | This parameter appears only when **Key Store** is selected in **Authentication**. Defines the URL of your JWKS key store. The verifying key is selected by the `kid` header of the incoming token. A JWT without a `kid` header is rejected. Cognigy caches the JWKS document for up to 10 minutes per URL. After rotating a key, tokens signed with the new key can fail and tokens signed with the removed key can still succeed for up to 10 minutes. | | Accept Only JWT Requests | Toggle | Activates JWT validation according to the method selected in **Authentication**. Requests that include only a user ID and session ID are blocked. This parameter is deactivated by default. Activating this parameter improves security by preventing unauthenticated access. When deactivated, Agent Copilot still extracts `userId` and `sessionId` if a JWT is present in the URL, but the signature isn't verified. For more information, see [JWT Authentication Methods](#jwt-authentication-methods). | | End Session On Handover Close | Toggle | This parameter appears only when **Workspace** or **Whisper** is selected in **Copilot Type**. Ends the Agent Copilot session immediately after the human agent resolves the conversation. After that, you can't send data to the Agent Copilot Flow from the Agent Copilot workspace. This parameter is activated by default. When deactivated, the Agent Copilot session stays open for the duration set in **Session TTL On Handover Close**. In this case, you can keep sending data to the Agent Copilot Flow through the Agent Copilot workspace after the human agent resolves the conversation. For more information, see [Send Data to the Agent Copilot Flow After Handover](#send-data-to-the-agent-copilot-flow-after-handover). | | Session TTL On Handover Close | Number | This parameter appears only when **End Session On Handover Close** is deactivated. Sets how long, in minutes, the Agent Copilot session stays open after the human agent resolves the conversation. The default value is `120`. | | Enable Branding | Toggle | This parameter appears only when **Copilot Type** is set to **Workspace**. Displays the **Powered by Cognigy.AI** branding at the bottom of the Agent Copilot workspace. This parameter is activated by default. This parameter works only if the contact center and Agent Copilot have different domains, for example: | > [!NOTE] > > As of Cognigy 2026.15.0, the **Authentication** list replaces the former **Enable Copilot Authentication** toggle. Previously configured Endpoints are migrated automatically. If the former toggle was: > > * Turned on — **Token Secret** is selected. > * Turned off — **Default (built-in)** is selected. > > No action is required. ## JWT Authentication Methods To secure access to Agent Copilot, the contact center platform signs a JWT containing `userId` and `sessionId`, then passes that signed JWT in the Agent Copilot URL as the `auth` parameter: ```txt theme={null} https://${AgentCopilotBaseUrl}/?URLToken=${URLToken}&auth={signed_JWT} ``` Each contact center platform has its own requirements for how the JWT signature is configured. Refer to your contact center platform documentation. Depending on the option you select in the **Authentication** list, you configure the authentication method differently: > [tab] Default (built-in) > > Agent Copilot handles the JWT authentication between the contact center platform and Cognigy. Activate **Accept Only JWT Requests** in the [Endpoint settings](#parameters). > [tab] Token Secret > > Symmetric authentication. The contact center platform and Cognigy share a single secret, used to both sign and verify the JWT. > > > [accordion] 1. On the Contact Center Side > > > > 1. Generate a 256-bit secret to use as the shared JWT secret. For example, you can use [OpenSSL](https://openssl-library.org/): > > > > ```sh theme={null} > > # Generate 32 random bytes (256 bits) and print them as a hex string > > openssl rand -hex 32 > > ``` > > > > Example output: `a3f7b9c2d8e14f6a0b5c9d3e7f2a8b4c6d0e9f3a7b1c5d8e2f4a6b9c3d7e1f85` > > > > 2. Copy the secret for later use and store it securely. > > > > 3. Sign JWTs with this secret. Agent Copilot accepts the `HS256`, `HS384`, and `HS512` HMAC algorithms. For example, use the [`jsonwebtoken` Node.js library](https://www.npmjs.com/package/jsonwebtoken): > > > > ```js HS256 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > 'a3f7b9c2d8e14f6a0b5c9d3e7f2a8b4c6d0e9f3a7b1c5d8e2f4a6b9c3d7e1f85', // shared secret > > { algorithm: 'HS256' } // HMAC using SHA-256 > > ); > > ``` > > > > ```js HS384 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > 'a3f7b9c2d8e14f6a0b5c9d3e7f2a8b4c6d0e9f3a7b1c5d8e2f4a6b9c3d7e1f85', // shared secret > > { algorithm: 'HS384' } // HMAC using SHA-384 > > ); > > ``` > > > > ```js HS512 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > 'a3f7b9c2d8e14f6a0b5c9d3e7f2a8b4c6d0e9f3a7b1c5d8e2f4a6b9c3d7e1f85', // shared secret > > { algorithm: 'HS512' } // HMAC using SHA-512 > > ); > > ``` > > > [accordion] 2. On the Cognigy Side > > > > 1. In the **Copilot** section in the Endpoint settings, select **Token Secret** in **Authentication**. > > 2. Next to **Agent Copilot Authentication**, click ![add JWT connection](https://mintcdn.com/cognigy-docs-legacy/eGdkyf6N-EPpPKZA/_assets/icons/black-and-white/plus-sign.svg?fit=max\&auto=format\&n=eGdkyf6N-EPpPKZA\&q=85\&s=6c618ceec3b83f76b1793e171bd4e8a2) and configure the connection: > > * **Connection name** — enter a unique name, for example, `copilot-token-secret`. > > * **JWT Secret** — enter the exact same 256-bit secret you previously generated for the contact center platform, for example, `a3f7b9c2d8e14f6a0b5c9d3e7f2a8b4c6d0e9f3a7b1c5d8e2f4a6b9c3d7e1f85`. > > 3. Activate **Accept Only JWT Requests**. > > 4. Click **Create**, then **Save**. > [tab] Public Key > > Asymmetric authentication. The contact center signs the JWT with a private key, and Cognigy verifies it with the corresponding public key. > > > [accordion] 1. On the Contact Center Side > > > > 1. Generate a public-private key pair. For example, you can use [OpenSSL](https://openssl-library.org/): > > > > **RSA:** > > > > ```sh theme={null} > > # Generate a 2048-bit RSA private key > > openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem > > # Derive the matching public key > > openssl pkey -in private.pem -pubout -out public.pem > > ``` > > > > **ECDSA P-256:** > > > > ```sh theme={null} > > # Generate a private key on the P-256 curve > > openssl ecparam -name prime256v1 -genkey -noout -out private.pem > > # Derive the matching public key > > openssl ec -in private.pem -pubout -out public.pem > > ``` > > 2. *(Optional)* If you want to use key rotation, generate multiple public-private key pairs. > > 3. Keep `private.pem` secret and store it in your own system. > > 4. Sign JWTs with `private.pem`. The algorithm you use depends on the key type. For example, use the [`jsonwebtoken` Node.js library](https://www.npmjs.com/package/jsonwebtoken): > > > > ```js RS256 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // RSA private key > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'RS256' } // RSA key, PKCS#1 v1.5 padding, SHA-256 > > ); > > ``` > > > > ```js RS384 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // RSA private key > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'RS384' } // RSA key, PKCS#1 v1.5 padding, SHA-384 > > ); > > ``` > > > > ```js RS512 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // RSA private key > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'RS512' } // RSA key, PKCS#1 v1.5 padding, SHA-512 > > ); > > ``` > > > > ```js PS256 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // RSA private key > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'PS256' } // RSA key, RSA-PSS padding, SHA-256 > > ); > > ``` > > > > ```js PS384 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // RSA private key > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'PS384' } // RSA key, RSA-PSS padding, SHA-384 > > ); > > ``` > > > > ```js PS512 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // RSA private key > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'PS512' } // RSA key, RSA-PSS padding, SHA-512 > > ); > > ``` > > > > ```js ES256 theme={null} > > const jwt = require('jsonwebtoken'); // JWT signing library > > const fs = require('fs'); > > > > const privateKey = fs.readFileSync('private.pem'); // ECDSA private key, P-256 curve > > > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { algorithm: 'ES256' } // ECDSA key on the P-256 curve, SHA-256 > > ); > > ``` > > > > `ES384` and `ES512` work the same way, but need a key generated on the P-384 or P-521 curve instead (`openssl ecparam -name secp384r1 ...` or `-name secp521r1 ...`) — the algorithm is tied to the curve the key was generated on. > > > [accordion] 2. On the Cognigy Side > > > > 1. In the **Copilot** section in the Endpoint settings, select **Public Key** in **Authentication**. > > > > 2. Enter the contents of the `public.pem` file into the **Public Keys** field. > > > > > [accordion] Public Key > > > > > > ```txt theme={null} > > > -----BEGIN PUBLIC KEY----- > > > MIICITANBgkqhkiG9w0BAQEFAAOCAg4AMIICCQKCAgBTPbIGqvbkfo55bY7IRJ8U > > > RUysKvl9X3qgSoJyDJhuydav7ssnxWnYFtBLziDQNeh1NsWF97bP7RkuCpyhnGYd > > > GuKfPa6NNX8bVrzDwMtI6nwQ8KShhyiYfkQAHz7hTh/yfF5W5rg1oRH0nuUtp/w4 > > > ukwaOHvDuz2td9pdZO6cNq1e1K96dOd7P+VRu3W27xM0cx5u5NHSFargz2WM/6+M > > > -----END PUBLIC KEY----- > > > ``` > > > > After you enter a public key in the field, another input field appears. Use the new input field to add another public key. > > > > 3. Activate **Accept Only JWT Requests**. > > 4. Click **Save**. > [tab] Key Store > > Asymmetric authentication. The contact center signs the JWT with a private key, and Cognigy verifies it with the corresponding public key by fetching it from a JWKS (JSON Web Key Set) endpoint you host. > > > [accordion] 1. On the Contact Center Side > > > > 1. Generate a public-private key pair, the same way as for **Public Key**. For example, you can use [OpenSSL](https://openssl-library.org/): > > > > ```sh theme={null} > > # Generate a 2048-bit RSA private key > > openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem > > # Derive the matching public key > > openssl pkey -in private.pem -pubout -out public.pem > > ``` > > > > 2. Host a JWKS endpoint that returns your public keys as JSON, each with a unique `kid`, for example: > > > > ```json theme={null} > > { > > "keys": [ > > { > > "kty": "RSA", > > "use": "sig", > > "kid": "copilot-key-2026-01", > > "alg": "RS256", > > "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw", > > "e": "AQAB" > > } > > ] > > } > > ``` > > > > 3. Sign JWTs with the matching private key, and set the `kid` header to the same value published in the JWKS. A JWT without a `kid` header is rejected. The algorithm you use depends on the key type, the same as for **Public Key**: > > > > ```js RS256 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { > > algorithm: 'RS256', // RSA key, PKCS#1 v1.5 padding, SHA-256 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > ```js RS384 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { > > algorithm: 'RS384', // RSA key, PKCS#1 v1.5 padding, SHA-384 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > ```js RS512 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { > > algorithm: 'RS512', // RSA key, PKCS#1 v1.5 padding, SHA-512 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > ```js PS256 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { > > algorithm: 'PS256', // RSA key, RSA-PSS padding, SHA-256 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > ```js PS384 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { > > algorithm: 'PS384', // RSA key, RSA-PSS padding, SHA-384 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > ```js PS512 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, > > { > > algorithm: 'PS512', // RSA key, RSA-PSS padding, SHA-512 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > ```js ES256 theme={null} > > const token = jwt.sign( > > { userId: 'user-123', sessionId: 'session-456' }, // payload > > privateKey, // ECDSA private key, P-256 curve > > { > > algorithm: 'ES256', // ECDSA key on the P-256 curve, SHA-256 > > keyid: 'copilot-key-2026-01' // must match a "kid" in the JWKS > > } > > ); > > ``` > > > > `ES384` and `ES512` work the same way, with a key generated on the P-384 or P-521 curve instead. > > > [accordion] 2. On the Cognigy Side > > > > 1. In the **Copilot** section in the Endpoint settings, select **Key Store** in **Authentication**. > > > > 2. Enter your JWKS URL in the **Key Store URL** field. The domain is specific to your system; the path is only a convention, not a requirement — any URL that returns a valid JWKS document works. For example: > > > > ```txt theme={null} > > https:///.well-known/jwks.json > > ``` > > > > 3. Activate **Accept Only JWT Requests**. > > > > 4. Click **Save**. ## Send Data to the Agent Copilot Flow after Handover If you need to allow human agents to send data to the Agent Copilot Flow after they resolve a conversation, for example, to change or add user data, deactivate **End Session On Handover Close** in the [Endpoint settings](#parameters). The Agent Copilot session then stays open after the human agent resolves the conversation, and the human agent can keep sending [postbacks](https://docs-classic.cognigy.com/ai/agents/develop/node-reference/agent-copilot/set-html-tile.md#send-json-data-back-to-the-flow) from the [Copilot: HTML Tile Node](https://docs-classic.cognigy.com/ai/agents/develop/node-reference/agent-copilot/set-html-tile.md) to the Agent Copilot Flow. When **End Session On Handover Close** is deactivated: * Postbacks sent from the Copilot: HTML Tile Node are processed by the Agent Copilot Flow. * The session ends when `SDK.endSession()` is called in the Copilot: HTML Tile Node or when the time set in **Session TTL On Handover Close** elapses. > [!NOTE] > > If an end user starts a second handover before the Agent Copilot session of the first handover ends, the second handover reuses the session and clears the workspace of the first handover. Human agents who have that workspace open see the `This Copilot session has ended.` message. When they refresh the page or open the workspace later, they see the tiles from the second handover. To prevent unexpected clearing, end the Agent Copilot session of the first handover before the end user can start a second handover. For example, call `SDK.endSession()`. > > This behavior doesn't apply to the [Voice Gateway](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/voice-gateway.md) and [Genesys](https://docs-classic.cognigy.com/ai/agents/deploy/endpoint-reference/genesys.md) Endpoints because they start new sessions for handovers. ### End the Session from the Copilot: HTML Tile Node To end an open session before the time set in **Session TTL On Handover Close** elapses, call `SDK.endSession()` in the [Copilot: HTML Tile Node](https://docs-classic.cognigy.com/ai/agents/develop/node-reference/agent-copilot/set-html-tile.md), for example from a button: ```html theme={null} ``` For more information, see [End Agent Copilot Session](https://docs-classic.cognigy.com/ai/agents/develop/node-reference/agent-copilot/set-html-tile.md#end-agent-copilot-session). ## More Information * [Endpoint Settings](https://docs-classic.cognigy.com/ai/agents/deploy/endpoints/overview) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.