Authentication

All requests to Recordari require an API key. Keys are scoped to your workspace and passed as a Bearer token on every request.

Personal keys vs. workspace keys

There are three kinds of key, and it's easy to reach for the wrong one:

• Personal key - tied to you. You self-mint it from your own account; nobody else, including a workspace Owner, can create one on your behalf. Use it for your own interactive agent sessions (Claude Code, Claude.ai, etc.) so what you file is attributed to you individually.
• Workspace key - shared, not tied to any one person. Use it for CI pipelines, shared automation, or any agent connection where individual attribution doesn't matter.
• Admin key - for the management API only (api.recordar.io/admin/*). It creates and revokes other keys but can't make MCP tool calls itself. Most people never need one - see Admin keys.

If you're just connecting your own agent, you want a personal key. If you're wiring up something the whole team depends on, use a workspace key.

Memories filed with your personal key are attributed to you individually. On shared domains, that affects who can change them and how disagreements are resolved — see When memories disagree.

A personal key is not a private workspace. Teammates on the same workspace can still read what you file. If you need a graph the team cannot see, you need a separate workspace — today that means a separate account signup; additional workspace creation under the same org is coming soon on Team tier and above. See Personal workspace in the engineering manager guide.

Generating a key

Personal key

1. Sign in at admin.recordar.io
2. Go to API Keys → Personal keys
3. Click New personal key, give it a label, and copy the value

You can self-mint up to 5 personal keys - see How many keys can I have? below.

Workspace key

1. Sign in at admin.recordar.io
2. Go to API Keys → Workspace keys
3. Click New key, give it a label, and copy the value

Workspace keys are created by an Owner, or programmatically with an admin key.

The key is shown once in both cases. If you lose it, revoke it and generate a new one.

Using your key

Pass it as a Bearer token in every request to api.recordar.io:

Authorization: Bearer YOUR_API_KEY

When you configure an MCP client like Claude Code, this goes in the headers block of your config:

{
  "mcpServers": {
    "recordari": {
      "type": "http",
      "url": "https://api.recordar.io/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Key types

Connecting your own agent? Use a personal key. Connecting a shared agent or pipeline? Use a workspace key. org_admin keys are for managing the workspace itself.

How many keys can I have?

Workspace keys connect agents and CI pipelines. Admin keys manage keys via the API - see Admin keys.

Personal keys are capped at 5 per user on every plan. This isn't a plan-tiered limit like the ones above - a personal key belongs to you, not your workspace, so it doesn't scale with your plan.

Rotating a key

When you need to rotate:

1. Generate a new key from the admin portal API Keys page
2. Update your .mcp.json (or wherever the key is stored) to use the new value
3. Revoke the old key from the admin portal

Revocation is immediate - any request using a revoked key gets a 401 response.

Keeping keys safe

A few things worth being deliberate about:

• Don't commit .mcp.json to version control if it contains a live key. Add it to .gitignore.
• Use environment variable references if your MCP client supports them.
• Use a personal key for your own interactive sessions and a workspace key for automated pipelines - it makes revocation much cleaner if something goes wrong.

Revoking a key

Go to API Keys in the admin portal, find the key, and click Revoke. This is permanent - the key cannot be reinstated.

• Personal keys - you can revoke your own at any time. A workspace admin can also revoke one on your behalf, for example when someone leaves the team.
• Workspace and admin keys - only an Owner, or an admin key, can revoke these.