---
title: "Authentication"
description: "One bearer key per organization. The project is the boundary of a memory."
canonical: https://past.dev/docs/memory-api/authentication
last-updated: 2026-08-26
---
# Authentication

> One bearer key per organization. The project is the boundary of a memory.

Product: past.dev Memory API. Source: https://past.dev/docs/memory-api/authentication

Every request carries `Authorization: Bearer $PAST_API_KEY`. Keys start with `past_sk_` and resolve their organization server-side, so a key can never read or write another tenant's content.

A key reaches the organization's projects. With one project, nothing else is needed. With several, pass `projectId` (an integer) on each request, or the call is refused with `ambiguous-project`. An unknown id is refused with `unknown-project`.

> **During early access**
>
> Keys are issued by hand. There is no dashboard, no programmatic issuance, and no rotation endpoint yet. Self-serve keys are dated in the roadmap below.