Authentication

API key authentication

All public API requests require an API key sent in the X-API-Key header:

curl https://api.memcontext.in/api/memories/search?query=... \
  -H "X-API-Key: mc_your_key"

Create API keys from the MemContext dashboard under Settings > API Keys. Each key is bound to one workspace selected at creation, and API-key requests cannot override that workspace. Keys are prefixed with mc_ and shown only once at creation - store them securely.

MCP server authentication

The hosted MCP server at https://mcp.memcontext.in/mcp accepts the API key via HTTP headers. Both MEMCONTEXT-API-KEY and X-API-Key are supported:

{
  "mcpServers": {
    "memcontext": {
      "url": "https://mcp.memcontext.in/mcp",
      "headers": {
        "MEMCONTEXT-API-KEY": "mc_your_key"
      }
    }
  }
}

See MCP Setup for configs specific to Claude Code, Cursor, OpenCode, and Codex CLI.

Claude.ai / Claude Desktop connector authentication

For Claude.ai and Claude Desktop custom connectors, MemContext uses OAuth instead of manual API-key entry.

Open Settings → Connectors in Claude.
Add a custom connector with https://mcp.memcontext.in/mcp.
Click Connect.
Sign in to MemContext and approve the requested scopes.

This path is intended for everyday Claude usage. API-key headers and config files are only needed for coding-agent setups such as Claude Code, Cursor, OpenCode, and Codex CLI.

OAuth for other MCP clients

The same OAuth flow works for any client that supports remote MCP authorization (MCP spec 2026-07-28 and earlier), including ChatGPT, Claude Code, Codex CLI, Cursor, VS Code, and OpenCode. Point the client at https://mcp.memcontext.in/mcp without an API key header; it discovers MemContext’s authorization server automatically, using Client ID Metadata Documents where supported and dynamic client registration otherwise.

On the consent screen, choose the workspace the connection should use. Each connection stays bound to that workspace.
Connections stay signed in: clients receive refresh tokens and renew access in the background, so you will not be asked to re-authorize every hour.
API keys keep working exactly as before and take precedence when a request includes both.

Rate limits

MemContext rate-limits requests per endpoint using fixed 1-minute windows. Authenticated memory endpoint limits scale with the workspace plan:

Plan	Save memory	Search memories	Submit feedback
Free	30/min	60/min	30/min
Hobby	100/min	200/min	60/min
Pro	300/min	600/min	120/min
Ultimate	1,000/min	2,000/min	300/min

API traffic may also be protected by a global abuse backstop of 3,000 requests per minute. Rate-limited responses include headers to help you manage request timing:

Header	Description
`X-RateLimit-Limit`	Maximum requests allowed in the current window
`X-RateLimit-Remaining`	Remaining requests in the current window
`X-RateLimit-Reset`	Unix timestamp when the window resets

When the limit is exceeded, the API returns 429 Too Many Requests.

Error responses

All errors follow a consistent JSON format:

{
  "error": "Human-readable error message",
  "code": "HTTP_429",
  "requestId": "abc123xyz456"
}

Field	Description
`error`	What went wrong
`code`	Machine-readable error code (e.g. `HTTP_401`, `HTTP_404`, `INTERNAL_ERROR`)
`requestId`	Unique request ID, also returned in the `X-Request-Id` response header
`errorId`	Unique error reference for support (only on server errors, format `ERR_XXXXXXXX`)

Common error codes:

Code	Status	Meaning
`HTTP_401`	401	Missing or invalid API key
`HTTP_403`	403	Memory limit exceeded for current plan
`HTTP_404`	404	Memory not found
`HTTP_429`	429	Rate limit exceeded
`INTERNAL_ERROR`	500	Unexpected server error

Request limits

Constraint	Value
Max request body size	50 KB
Max memory content length	10,000 characters
Max search query length	1,000 characters
Max feedback context length	1,000 characters

Best practices

Create a separate API key per integration or environment
Keep API keys server-side - never expose them in client-side code
Rotate keys immediately if you suspect exposure
Use scope as the hard isolation boundary when one API key serves multiple app users or tenants
Use project only as a secondary grouping/filter inside that scope

Get Started

Concepts

Context Vault

Guides

SDK

API Reference

MCP Tools

API key authentication

MCP server authentication

Claude.ai / Claude Desktop connector authentication

OAuth for other MCP clients

Rate limits

Error responses

Request limits

Best practices

​API key authentication

​MCP server authentication

​Claude.ai / Claude Desktop connector authentication

​OAuth for other MCP clients

​Rate limits

​Error responses

​Request limits

​Best practices

API key authentication

MCP server authentication

Claude.ai / Claude Desktop connector authentication

OAuth for other MCP clients

Rate limits

Error responses

Request limits

Best practices