> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memorylake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and API Keys

> One API key authenticates the REST API, Model Router, and agent plugins — how to create, use, and manage keys

## One Key, Every Surface

MemoryLake uses API keys (`sk-…`) as the credential for all programmatic access. The same key authenticates:

| Surface                                   | Base URL                                                 | Auth header                                                            |
| ----------------------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------- |
| MemoryLake REST API                       | `https://app.memorylake.ai/openapi/memorylake`           | `Authorization: Bearer sk-…`                                           |
| Model Router (OpenAI-compatible)          | `https://app.memorylake.ai/v1`                           | `Authorization: Bearer sk-…`                                           |
| Model Router (Claude-native)              | `https://app.memorylake.ai/claude/v1`                    | `x-api-key: sk-…`                                                      |
| Model Router (Gemini-native)              | `https://app.memorylake.ai/gemini/:version`              | `x-goog-api-key: sk-…`                                                 |
| Memory Router (private preview)           | `https://app.memorylake.ai/openai/v1` · `…/anthropic/v1` | native header, see [Memory Router](/features/memory-router/quickstart) |
| Agent plugins (OpenClaw / QClaw / Hermes) | configured once during install                           | plugin config `apiKey`                                                 |
| MCP clients                               | `https://app.memorylake.ai/memorylake/mcp/v2`            | OAuth2 — no key needed                                                 |

<Note>
  MCP clients don't use API keys at all — they authorize with OAuth2 and pick their scope on the consent screen. See [Connect via MCP](/features/memorylake/mcp-servers/creating-api-keys).
</Note>

## Creating an API Key

1. Open **API Keys** in the [console](https://app.memorylake.ai) sidebar
2. Click create and fill in:
   * **Name** — for your own reference, changeable later
   * **Expiry** — Never / 7 days / 30 days (default) / 90 days / 1 year / custom date
   * **Advanced → Group** — optional model-access group, when your account has more than one
3. Copy the revealed `sk-…` key immediately — it is shown in full **only once**

<Warning>
  Store keys in a password manager or environment variables. Never commit them to version control or share them in chat. If a key leaks, **rotate** it from the key's detail panel — rotation issues a new secret without recreating your configuration.
</Warning>

## What a Key Can Do

An API key inherits the permissions of the member who created it. In your personal space that means full access to your own resources; in a team space, a key can do exactly what its creator's role and [resource scopes](/features/team-collaboration/permission-reference) allow — no more.

Per-key controls available from the key detail panel:

* **Enable / disable** — suspend a key without deleting it
* **Rotate** — replace the secret, keep the key's identity
* **Model restrictions** — limit which models the key may call
* **IP allowlist** — restrict usage to known addresses
* **Heartbeat** — optionally require periodic liveness signals for long-running automation

Key states: **enabled**, **disabled**, **expired**, and **exhausted** (quota depleted). Requests with a key in any non-enabled state are rejected.

## Using Your Key

<CodeGroup>
  ```bash MemoryLake REST API theme={null}
  curl https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces \
    -H "Authorization: Bearer sk-your-key"
  ```

  ```bash Model Router (OpenAI-compatible) theme={null}
  curl https://app.memorylake.ai/v1/chat/completions \
    -H "Authorization: Bearer sk-your-key" \
    -H "Content-Type: application/json" \
    -d '{
      "model": "gpt-4o-mini",
      "messages": [{"role": "user", "content": "hi"}]
    }'
  ```

  ```bash Model Router (Claude-native) theme={null}
  curl https://app.memorylake.ai/claude/v1/messages \
    -H "x-api-key: sk-your-key" \
    -H "anthropic-version: 2023-06-01" \
    -H "Content-Type: application/json" \
    -d '{
      "model": "claude-sonnet-5",
      "max_tokens": 1024,
      "messages": [{"role": "user", "content": "hi"}]
    }'
  ```
</CodeGroup>

The console's API Keys page always shows your current **API base address** with a copy button, plus setup guides for common integrations.

## Personal vs. Team Context

Keys are created within a space — personal or team. A key created in a team space operates in that team's context: its calls draw on team quota and see team resources (per the creator's permissions). Check which space you are in (sidebar space switcher) before creating keys for automation.

## Troubleshooting

* **`401 Unauthorized`** — key missing, mistyped, disabled, or expired. Verify the exact header format for the surface you're calling (table above).
* **Quota errors** — the account or team balance is insufficient; check **Billing** in the console.
* **Model not available** — the key's group or model restrictions exclude that model; list available models first (see [Model Router](/features/model-router/list-available-models)).

## Limitations and Notes

* API keys are the only programmatic credential — console login sessions cannot call the APIs.
* A key's permissions track its creator: if the creator's role is downgraded or they leave the team, the key's access changes accordingly.