API Authentication - MemoryLake AI

curl -X GET 'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json'

const response = await fetch(
  'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123',
  {
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json'
    }
  }
);

const data = await response.json();

import requests

headers = {
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json'
}

response = requests.get(
    'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123',
    headers=headers
)

data = response.json()

{
  "success": true,
  "data": {
    "id": "ws_abc123",
    "name": "My Workspace",
    "description": "Research workspace"
  }
}

{
  "success": false,
  "message": "Invalid or missing API key",
  "error_code": "UNAUTHORIZED"
}

curl -X GET 'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json'

const response = await fetch(
  'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123',
  {
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json'
    }
  }
);

const data = await response.json();

import requests

headers = {
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json'
}

response = requests.get(
    'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123',
    headers=headers
)

data = response.json()

{
  "success": true,
  "data": {
    "id": "ws_abc123",
    "name": "My Workspace",
    "description": "Research workspace"
  }
}

{
  "success": false,
  "message": "Invalid or missing API key",
  "error_code": "UNAUTHORIZED"
}

Authentication

All API requests require an API key passed via the Authorization header.

Obtaining an API Key

Navigate to a project in the MemoryLake console
Go to the API Keys tab
Click “Create API Key”
Copy the generated secret (format: sk_xxxxxx)

The API key secret is shown only once at creation. Store it securely — it cannot be retrieved again.

What a Key Can Do

A key is bound to exactly one team — the team it was created under. Nothing in a request can change that: there is no team parameter, and no header overrides it. If you belong to several teams, you hold one key per team, and you govern a team with that team’s key. Within its team, a key acts with its creator’s role. This matters most on the Management API, whose endpoints are authorized against what that person may do in the console — a member’s key reads the team roster, an owner’s key can also change it. If the creator loses a permission or leaves the team, their keys lose it too. A key that authenticates but lacks the required permission gets 403 with ACCESS_DENIED.

For automation that only needs to read, prefer a key created by a low-privilege member — or one issued for a virtual member. That is the cleanest way to limit what a leaked key can do.

Using API Keys

Include the API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Example Request

curl -X GET 'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123' \
  -H 'Authorization: Bearer sk_xxxxxx' \
  -H 'Content-Type: application/json'

const response = await fetch(
  'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123',
  {
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json'
    }
  }
);

const data = await response.json();

import requests

headers = {
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json'
}

response = requests.get(
    'https://app.memorylake.ai/openapi/memorylake/api/v3/workspaces/ws_abc123',
    headers=headers
)

data = response.json()

Response

{
  "success": true,
  "data": {
    "id": "ws_abc123",
    "name": "My Workspace",
    "description": "Research workspace"
  }
}

{
  "success": false,
  "message": "Invalid or missing API key",
  "error_code": "UNAUTHORIZED"
}

Error Responses

401 Unauthorized

Returned when the API key is missing or invalid:

{
  "success": false,
  "message": "Unauthorized access",
  "error_code": "UNAUTHORIZED"
}

Solutions:

Verify API key is included in Authorization header
Check header format: Bearer YOUR_KEY
Ensure key hasn’t been deleted
Generate new key if lost

403 Forbidden

Returned when authentication is valid but the API key lacks sufficient permissions:

{
  "success": false,
  "message": "Access denied to this resource",
  "error_code": "FORBIDDEN"
}

Solutions:

Verify project ID is correct
Check API key is for the correct project
Ensure resource exists

Security Best Practices

Secure Storage

Store API keys in environment variables
Never commit keys to version control
Use secrets management services
Rotate keys periodically

Key Management

Create separate keys per environment
Use descriptive names for keys
Delete unused keys promptly
Monitor key usage

Request Security

Always use HTTPS
Don’t log API keys
Implement request timeouts
Handle errors gracefully

Next Steps

Core Memory Operations

Start with the core APIs

Error Handling

Handle API errors

​Authentication

​Obtaining an API Key

​What a Key Can Do

​Using API Keys

​Example Request

​Response

​Error Responses

​401 Unauthorized

​403 Forbidden

​Security Best Practices

​Next Steps

Core Memory Operations

Error Handling

Authentication

Obtaining an API Key

What a Key Can Do

Using API Keys

Example Request

Response

Error Responses

401 Unauthorized

403 Forbidden

Security Best Practices

Next Steps