> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every Memic API call is authenticated with a single API key bound to one environment.

Memic uses API key authentication. Every request must include your key in the
`X-API-Key` header:

```bash theme={null}
curl https://api.memic.ai/api/v1/me \
  -H "X-API-Key: mk_live_..."
```

If the header is missing or invalid, the API returns `401 Unauthorized`.

## Getting an API key

1. Sign in to the [Memic dashboard](https://memic.ai/dashboard)
2. Navigate to your environment (for example `production`)
3. Go to **API Keys**, click **Create key**
4. Copy the key — it's shown only once

<Warning>
  Store API keys as secrets. Never commit them to source control. Use
  environment variables (`MEMIC_API_KEY`) or a secret manager.
</Warning>

## What an API key represents

Every Memic API key is bound to **exactly one environment**. When Memic
receives a request, it resolves the full context (organization, project,
environment, folder access) from the key alone. That's why endpoint URLs
don't take `org_id`, `project_id`, or `environment_slug` as path parameters.

```bash theme={null}
# You do this:
POST /api/v1/search

# Not this:
POST /api/v1/organizations/{org_id}/projects/{project_id}/environments/{slug}/search
```

Call `GET /me` to see exactly what context your key resolves to:

```json theme={null}
{
  "organization_id": "fc4dab50-...",
  "organization_name": "Acme Corp",
  "project_id": "49d4ff53-...",
  "project_name": "Tech companies",
  "environment_id": "...",
  "environment_slug": "production"
}
```

## Switching environments

Because each key is tied to one environment, switching environments means
swapping keys — not changing URLs:

```python theme={null}
# staging
client = Memic(api_key="mk_live_staging_...")

# production — same code, different key
client = Memic(api_key="mk_live_prod_...")
```

This is what makes Memic multi-tenant-safe by default: you can't accidentally
call a search endpoint against the wrong environment, because the key
wouldn't have access.

## Rotating keys

Best practice:

1. Create a new key in the dashboard
2. Deploy it to your application
3. Delete the old key

Memic does not enforce key expiration, but you should rotate keys at least
annually, and immediately if you suspect a key has been compromised.

## Revoking a compromised key

Deleting a key in the dashboard takes effect immediately. Any in-flight
requests using the old key will complete, but new requests will return
`401 Unauthorized` within seconds.

## Related

<CardGroup cols={2}>
  <Card title="Errors" icon="triangle-exclamation" href="/api-reference/errors">
    Error response format and codes.
  </Card>

  <Card title="Core concepts" icon="diagram-project" href="/core-concepts">
    How environments isolate tenants.
  </Card>
</CardGroup>