Get started

Authentication

How requests are admitted and scoped across the namespaces.

One credential secures the whole server: every namespace requires an X-API-Key header carrying a registered key. There is no second mechanism and no per-namespace exception.

Admission (X-API-Key)

The RequireAPIKey middleware guards the whole mux, so every namespace verifies the key beforedispatch — a namespace cannot forget the check, and a new one inherits it for free. A missing, malformed, or unregistered key gets a 401 and no tool ever runs. GET /healthz is the one exempt route, so an uptime probe needs no credential; it reveals only liveness.

request header

X-API-Key: <your-key>

Per-caller scope (memory)

The memory namespace resolves the same key a second time, to an api_key_idthat scopes every store call — so one caller can never read another’s memories. That is the key used as an identity, not merely as admission, which is why the check lives in both places.

Admission vs. scoping

Every namespace requires a key to be reached. Only memory uses it to partition data — the other tools hold no per-caller state, so any valid key sees the same thing.