> ## Documentation Index
> Fetch the complete documentation index at: https://docs.remem.online/llms.txt
> Use this file to discover all available pages before exploring further.
# Authentication: API Keys and Security Best Practices
> Every Remem API request requires an API key in the X-API-Key header. Keys follow the rm_live_ format and are issued free at dev.remem.online.
Every request you make to the Remem API must be authenticated with an API key. Authentication is stateless — there are no sessions, no OAuth flows, and no token exchanges. You pass your key in a single HTTP header and every endpoint authorises it the same way.
## API Keys
Pass your API key in the `X-API-Key` header on every request:
```bash theme={null}
curl "https://api.remem.online/memories/search?query=test&user_id=u1&agent_id=bot" \
-H "X-API-Key: rm_live_xxx"
```
Remem does not support query-string authentication. The header is required — requests without it return `401` immediately.
## Key Format
Every Remem API key begins with the prefix `rm_live_` followed by a long random string:
```text theme={null}
rm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```
If your key does not start with `rm_` you will receive a `401 Invalid API key format` error immediately. Double-check you are copying the full key exactly as it was delivered to your inbox.
## Getting Your Key
Visit [dev.remem.online](https://dev.remem.online) and create a free account with your name and email address. No credit card is required to get started.
Your API key is sent to your inbox within 60 seconds of signing up. If it does not arrive, check your spam folder. The subject line is **Your Remem API Key**.
The key is shown exactly once — in the email. Remem cannot display it again after issuance. Copy it to a password manager or your project's secrets store immediately.
Add the key to your environment variables and initialise the client. The free plan activates immediately — there is no approval process and no waiting period.
## Using Your Key Safely
Never hardcode your API key directly in source code. Anyone who reads your code — including version control history after a `git push` — can extract it.
```python theme={null}
# Wrong — key is visible in source code and version history
client = RememClient(api_key="rm_live_xxx")
# Correct — key is read from the environment at runtime
import os
client = RememClient(api_key=os.getenv("REMEM_API_KEY"))
```
Store your key in a `.env` file locally:
```bash theme={null}
# .env
REMEM_API_KEY=rm_live_xxx
```
In production, use your deployment platform's secrets manager — AWS Secrets Manager, Vercel environment variables, Railway secret variables, and so on. The key should never travel through your repository.
Before you commit anything, make sure your `.env` file is excluded from version control:
```bash theme={null}
# .gitignore
.env
.env.local
.env.production
.env.staging
```
If you accidentally commit a file containing your key, revoke it immediately by emailing [support@remem.online](mailto:support@remem.online) — then generate a new one. Assume the leaked key is compromised the moment it appears in a commit, even briefly.
Email [**support@remem.online**](mailto:support@remem.online) from your registered email address and ask for a key reset. The team will revoke your existing key and issue a new one. Your old key stops working the moment it is revoked — any integrations using it will start returning `401` and will need to be updated with the new key.
## Error Responses
| Code | Meaning | What to do |
| ----- | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401` | Missing, malformed, or revoked API key | Confirm your key starts with `rm_` and matches exactly what was emailed to you. If lost, request a new key at [support@remem.online](mailto:support@remem.online) |
| `403` | Account suspended | Contact [support@remem.online](mailto:support@remem.online) to understand the reason and resolve it |
| `402` | Plan memory limit reached | Upgrade your plan at [remem.online/pricing](https://dev.remem.online) to increase your limit |
## SDK Usage
When you use the Python SDK, you pass the key once during client initialisation. Every subsequent method call sends it automatically — you never touch the header yourself:
```python theme={null}
import os
from remem import RememClient
client = RememClient(
api_key=os.getenv("REMEM_API_KEY"),
base_url="https://api.remem.online",
)
# The X-API-Key header is attached to every call automatically
client.remember("User prefers dark mode", user_id="u1", agent_id="bot")
client.recall("display preferences", user_id="u1", agent_id="bot")
client.context(user_id="u1", agent_id="bot")
```
## REST API (No SDK)
If you are calling the API directly without the SDK, include the `X-API-Key` header on every individual request.
```bash curl theme={null}
curl -X POST "https://api.remem.online/memories" \
-H "X-API-Key: rm_live_xxx" \
-H "Content-Type: application/json" \
-d '{
"content": "User prefers dark mode",
"user_id": "user_123",
"agent_id": "support_bot"
}'
```
```python Python (httpx) theme={null}
import httpx
resp = httpx.post(
"https://api.remem.online/memories",
headers={
"X-API-Key": "rm_live_xxx",
"Content-Type": "application/json",
},
json={
"content": "User prefers dark mode",
"user_id": "user_123",
"agent_id": "support_bot",
},
)
print(resp.status_code) # 200
print(resp.json())
```
```javascript JavaScript (fetch) theme={null}
const response = await fetch("https://api.remem.online/memories", {
method: "POST",
headers: {
"X-API-Key": "rm_live_xxx",
"Content-Type": "application/json",
},
body: JSON.stringify({
content: "User prefers dark mode",
user_id: "user_123",
agent_id: "support_bot",
}),
});
const data = await response.json();
console.log(data);
```