Skip to main content

​
One Key, Every Surface

MemoryLake uses API keys (sk-…) as the credential for all programmatic access. The same key authenticates:
MCP clients don’t use API keys at all — they authorize with OAuth2 and pick their scope on the consent screen. See Connect via MCP.

​
Creating an API Key

  1. Open API Keys in the console sidebar
  2. Click create and fill in:
    • Name — for your own reference, changeable later
    • Expiry — Never / 7 days / 30 days (default) / 90 days / 1 year / custom date
    • Advanced → Group — optional model-access group, when your account has more than one
  3. Copy the revealed sk-… key immediately — it is shown in full only once
Store keys in a password manager or environment variables. Never commit them to version control or share them in chat. If a key leaks, rotate it from the key’s detail panel — rotation issues a new secret without recreating your configuration.

​
What a Key Can Do

An API key inherits the permissions of the member who created it. In your personal space that means full access to your own resources; in a team space, a key can do exactly what its creator’s role and resource scopes allow — no more. Per-key controls available from the key detail panel:
  • Enable / disable — suspend a key without deleting it
  • Rotate — replace the secret, keep the key’s identity
  • Model restrictions — limit which models the key may call
  • IP allowlist — restrict usage to known addresses
  • Heartbeat — optionally require periodic liveness signals for long-running automation
Key states: enabled, disabled, expired, and exhausted (quota depleted). Requests with a key in any non-enabled state are rejected.

​
Using Your Key

The console’s API Keys page always shows your current API base address with a copy button, plus setup guides for common integrations.

​
Personal vs. Team Context

Keys are created within a space — personal or team. A key created in a team space operates in that team’s context: its calls draw on team quota and see team resources (per the creator’s permissions). Check which space you are in (sidebar space switcher) before creating keys for automation.

​
Troubleshooting

  • 401 Unauthorized — key missing, mistyped, disabled, or expired. Verify the exact header format for the surface you’re calling (table above).
  • Quota errors — the account or team balance is insufficient; check Billing in the console.
  • Model not available — the key’s group or model restrictions exclude that model; list available models first (see Model Router).

​
Limitations and Notes

  • API keys are the only programmatic credential — console login sessions cannot call the APIs.
  • A key’s permissions track its creator: if the creator’s role is downgraded or they leave the team, the key’s access changes accordingly.