Docs Memory API
Authentication
Every request carries a project key as a bearer token. The key names the project; there is no project id in request bodies.
#Sending the key
Request
curl "$AULD_API_BASE/v1/project" -H "Authorization: Bearer $AULD_API_KEY"Requests without a valid key return 401 unauthenticated. Keys belong to exactly one project.
#Key types
| Type | Prefix | Can | Use in |
|---|---|---|---|
| Secret key | sk_ | All endpoints | Backends and server-side tools |
| Recall key | rk_ | Recall and answer only | Read-only services, analytics |
| MCP token | mk_ | MCP tools enabled for it | MCP clients; see admin controls |
#Keeping keys safe
- Never ship a secret key to a browser or mobile app. Proxy calls through your backend.
- Store keys in your secrets manager; read them from the environment at runtime.
- Create one key per service so you can rotate or revoke one without touching others.
- Rotate by creating a new key, deploying it, then revoking the old one.
#Identity is not authentication
The viewer in a recall says whose view of memory to return; Auld trusts your backend to set it. Always derive it from your own authenticated session, never from user or model input.