Skip to content

authentication.mdx

Latest commit

 

History

History
97 lines (74 loc) · 4.78 KB

authentication.mdx

File metadata and controls

97 lines (74 loc) · 4.78 KB
Raw
title Authentication and API Keys
description One API key authenticates the REST API, Model Router, and agent plugins — how to create, use, and manage keys

One Key, Every Surface

MemoryLake uses API keys (sk-…) as the credential for all programmatic access. The same key authenticates:

Surface Base URL Auth header
MemoryLake REST API https://app.memorylake.ai/openapi/memorylake Authorization: Bearer sk-…
Model Router (OpenAI-compatible) https://app.memorylake.ai/v1 Authorization: Bearer sk-…
Model Router (Claude-native) https://app.memorylake.ai/claude/v1 x-api-key: sk-…
Model Router (Gemini-native) https://app.memorylake.ai/gemini/:version x-goog-api-key: sk-…
Memory Router (private preview) https://app.memorylake.ai/openai/v1 · …/anthropic/v1 native header, see Memory Router
Agent plugins (OpenClaw / QClaw / Hermes) configured once during install plugin config apiKey
MCP clients https://app.memorylake.ai/memorylake/mcp/v2 OAuth2 — no key needed
MCP clients don't use API keys at all — they authorize with OAuth2 and pick their scope on the consent screen. See [Connect via MCP](/features/memorylake/mcp-servers/creating-api-keys).

Creating an API Key

  1. Open API Keys in the console sidebar
  2. Click create and fill in:
    • Name — for your own reference, changeable later
    • Expiry — Never / 7 days / 30 days (default) / 90 days / 1 year / custom date
    • Advanced → Group — optional model-access group, when your account has more than one
  3. Copy the revealed sk-… key immediately — it is shown in full only once
Store keys in a password manager or environment variables. Never commit them to version control or share them in chat. If a key leaks, **rotate** it from the key's detail panel — rotation issues a new secret without recreating your configuration.

What a Key Can Do

An API key inherits the permissions of the member who created it. In your personal space that means full access to your own resources; in a team space, a key can do exactly what its creator's role and resource scopes allow — no more.

Per-key controls available from the key detail panel:

  • Enable / disable — suspend a key without deleting it
  • Rotate — replace the secret, keep the key's identity
  • Model restrictions — limit which models the key may call
  • IP allowlist — restrict usage to known addresses
  • Heartbeat — optionally require periodic liveness signals for long-running automation

Key states: enabled, disabled, expired, and exhausted (quota depleted). Requests with a key in any non-enabled state are rejected.

Using Your Key

```bash MemoryLake REST API curl https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces \ -H "Authorization: Bearer sk-your-key" ``` 
curl https://app.memorylake.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-your-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [{"role": "user", "content": "hi"}]
  }'
curl https://app.memorylake.ai/claude/v1/messages \
  -H "x-api-key: sk-your-key" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-sonnet-5",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "hi"}]
  }'

The console's API Keys page always shows your current API base address with a copy button, plus setup guides for common integrations.

Personal vs. Team Context

Keys are created within a space — personal or team. A key created in a team space operates in that team's context: its calls draw on team quota and see team resources (per the creator's permissions). Check which space you are in (sidebar space switcher) before creating keys for automation.

Troubleshooting

  • 401 Unauthorized — key missing, mistyped, disabled, or expired. Verify the exact header format for the surface you're calling (table above).
  • Quota errors — the account or team balance is insufficient; check Billing in the console.
  • Model not available — the key's group or model restrictions exclude that model; list available models first (see Model Router).

Limitations and Notes

  • API keys are the only programmatic credential — console login sessions cannot call the APIs.
  • A key's permissions track its creator: if the creator's role is downgraded or they leave the team, the key's access changes accordingly.