Authentication

Authentication is fail-closed by default. If REMEM_API_KEY is empty and REMEM_ALLOW_AUTH_DISABLED is not set to true, remem-server returns HTTP 500 on every request — it will not silently run open. You must either set an API key or explicitly opt in to running without one.

Enabling auth

Start remem-server with REMEM_API_KEY set:

docker run -d --name remem-server -p 4545:4545 \
  -v remem-data:/var/lib/remem \
  -e REMEM_API_KEY=your-secret-key \
  rememorg/remem-community:server-latest

See Docker Compose for the full docker-compose.yml. If you also run the remem-mcp stdio binary (see MCP Overview), give it the same REMEM_API_KEY so it can forward it as a bearer token.

Making authenticated requests

Add either the Authorization header or the X-API-Key header to every request:

curl -X POST http://localhost:4545/api/v1/memories \
  -H "Authorization: Bearer your-secret-key" \
  -H "Content-Type: application/json" \
  -d '{"content": "...", "memory_type": "long_term"}'

curl -X POST http://localhost:4545/api/v1/memories \
  -H "X-API-Key: your-secret-key" \
  -H "Content-Type: application/json" \
  -d '{"content": "...", "memory_type": "long_term"}'

Disabling auth for local development

To run without an API key (development only), explicitly set:

docker run -p 4545:4545 -v remem-data:/var/lib/remem \
  -e REMEM_ALLOW_AUTH_DISABLED=true \
  rememorg/remem-community:server-latest

Without REMEM_ALLOW_AUTH_DISABLED=true, an empty REMEM_API_KEY is treated as a misconfiguration, not an “open” mode — every request fails with 500 until you fix one of the two settings.

Unauthenticated endpoints

These three endpoints never require a key, so health checks and API discovery work before you’ve provisioned credentials:

• GET /api/v1/health
• GET /api/v1/ready
• GET /api/v1/openapi.json

Every other endpoint, including GET /api/v1/health/deep, requires auth once auth is enabled.

Request tracing

Every request and response includes an X-Request-ID header. If you provide it in the request, Remem echoes it back. If you don’t, Remem generates one. Use this for distributed tracing correlation.

curl -X GET http://localhost:4545/api/v1/health \
  -H "X-Request-ID: my-trace-id-123"
# Response includes: X-Request-ID: my-trace-id-123