Authentication

Humans use Google. Machines use API keys. The Memory API owns both.

Google OAuth

The dashboard signs in with Auth.js. On success it posts the Google ID token to POST /auth/google. The API issues a session JWT used for key management and listing memories.

API keys

Create keys in the dashboard. Format is mem_… — last 4 characters are stored for display. The plaintext is shown once. Send it as Authorization: Bearer on every machine call (MCP, SDK, or CLI). Put it in MEMORY_API_KEY, not in prompts or AGENTS.md.