Authentication: API Keys and Security Best Practices

Every request you make to the Remem API must be authenticated with an API key. Authentication is stateless — there are no sessions, no OAuth flows, and no token exchanges. You pass your key in a single HTTP header and every endpoint authorises it the same way.

API Keys

Pass your API key in the X-API-Key header on every request:

curl "https://api.remem.online/memories/search?query=test&user_id=u1&agent_id=bot" \
  -H "X-API-Key: rm_live_xxx"

Remem does not support query-string authentication. The header is required — requests without it return 401 immediately.

Key Format

Every Remem API key begins with the prefix rm_live_ followed by a long random string:

rm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

If your key does not start with rm_ you will receive a 401 Invalid API key format error immediately. Double-check you are copying the full key exactly as it was delivered to your inbox.

Getting Your Key

Visit dev.remem.online and create a free account with your name and email address. No credit card is required to get started.

Check your email

Your API key is sent to your inbox within 60 seconds of signing up. If it does not arrive, check your spam folder. The subject line is Your Remem API Key.

Save it somewhere safe

The key is shown exactly once — in the email. Remem cannot display it again after issuance. Copy it to a password manager or your project’s secrets store immediately.

Start building

Add the key to your environment variables and initialise the client. The free plan activates immediately — there is no approval process and no waiting period.

Using Your Key Safely

Always use environment variables

Never hardcode your API key directly in source code. Anyone who reads your code — including version control history after a git push — can extract it.

# Wrong — key is visible in source code and version history
client = RememClient(api_key="rm_live_xxx")

# Correct — key is read from the environment at runtime
import os
client = RememClient(api_key=os.getenv("REMEM_API_KEY"))

Store your key in a .env file locally:

# .env
REMEM_API_KEY=rm_live_xxx

In production, use your deployment platform’s secrets manager — AWS Secrets Manager, Vercel environment variables, Railway secret variables, and so on. The key should never travel through your repository.

Add .env to .gitignore

Before you commit anything, make sure your .env file is excluded from version control:

# .gitignore
.env
.env.local
.env.production
.env.staging

If you accidentally commit a file containing your key, revoke it immediately by emailing support@remem.online — then generate a new one. Assume the leaked key is compromised the moment it appears in a commit, even briefly.

Lost your key?

Email support@remem.online from your registered email address and ask for a key reset. The team will revoke your existing key and issue a new one. Your old key stops working the moment it is revoked — any integrations using it will start returning 401 and will need to be updated with the new key.

Error Responses

Code	Meaning	What to do
`401`	Missing, malformed, or revoked API key	Confirm your key starts with `rm_` and matches exactly what was emailed to you. If lost, request a new key at support@remem.online
`403`	Account suspended	Contact support@remem.online to understand the reason and resolve it
`402`	Plan memory limit reached	Upgrade your plan at remem.online/pricing to increase your limit

SDK Usage

When you use the Python SDK, you pass the key once during client initialisation. Every subsequent method call sends it automatically — you never touch the header yourself:

import os
from remem import RememClient

client = RememClient(
    api_key=os.getenv("REMEM_API_KEY"),
    base_url="https://api.remem.online",
)

# The X-API-Key header is attached to every call automatically
client.remember("User prefers dark mode", user_id="u1", agent_id="bot")
client.recall("display preferences", user_id="u1", agent_id="bot")
client.context(user_id="u1", agent_id="bot")

REST API (No SDK)

If you are calling the API directly without the SDK, include the X-API-Key header on every individual request.

curl -X POST "https://api.remem.online/memories" \
  -H "X-API-Key: rm_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "content":  "User prefers dark mode",
    "user_id":  "user_123",
    "agent_id": "support_bot"
  }'

import httpx

resp = httpx.post(
    "https://api.remem.online/memories",
    headers={
        "X-API-Key":    "rm_live_xxx",
        "Content-Type": "application/json",
    },
    json={
        "content":  "User prefers dark mode",
        "user_id":  "user_123",
        "agent_id": "support_bot",
    },
)

print(resp.status_code)  # 200
print(resp.json())

const response = await fetch("https://api.remem.online/memories", {
  method: "POST",
  headers: {
    "X-API-Key":    "rm_live_xxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    content:  "User prefers dark mode",
    user_id:  "user_123",
    agent_id: "support_bot",
  }),
});

const data = await response.json();
console.log(data);

Get Started

Concepts

Guides

Authentication: API Keys and Security Best Practices

API Keys

Key Format

Getting Your Key

Using Your Key Safely

Error Responses

SDK Usage

REST API (No SDK)

​API Keys

​Key Format

​Getting Your Key

​Using Your Key Safely

​Error Responses

​SDK Usage

​REST API (No SDK)

API Keys

Key Format

Getting Your Key

Using Your Key Safely

Error Responses

SDK Usage

REST API (No SDK)