Authentication

Every Anona Memory request authenticates with a Bearer API key.

curl -X POST https://api.anonalabs.com/v1/record \
  -H "Authorization: Bearer anona_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"space_id": "customer-support-bot", "content": "User data"}'

Getting a key

Create an account at the dashboard and verify your email. Sign-in is blocked until you do.

Create the key

Go to API keys → New key, choose an environment, and give the key a name. Signing up does not create one for you.

Copy it immediately

The full key is shown once. Afterwards only its prefix is visible, in the dashboard and in the API.

Environment	Format	Intended for
`live`	`anona_live_<random>`	Production traffic
`test`	`anona_test_<random>`	Local development and CI

Keys can also be created and revoked programmatically. See API Keys.

Handling keys safely

Practice	Why
Treat the key like a password	It carries your organization’s full data-plane access.
Never commit it to version control	Load it from an environment variable or a secret manager instead.
Never call the API from a browser	A client-side key is public. Proxy through your own backend.
Use `test` keys outside production	Keeps development traffic off your production space and quota.
Rotate on a schedule, or immediately on exposure	Create the new key, cut traffic over, then revoke the old one.

export ANONA_API_KEY="anona_live_YOUR_KEY"

import os
from anona import AnonaClient

client = AnonaClient(api_key=os.environ["ANONA_API_KEY"])

const apiKey = process.env.ANONA_API_KEY;

Organization and space context

Every request runs in the context of the organization behind the API key, plus the space_id you supply. Spaces belonging to another organization are unreachable; the boundary is enforced at the gateway and again at the database layer.

Rate limiting

Requests are rate-limited per organization according to your plan. Current limits are returned on every response:

X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Window
X-Credits-Remaining

Exceeding the limit returns 429 with code rate_limited. Retry with exponential backoff. See Usage for reading your limits directly.

Authentication errors

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key",
    "request_id": "req_..."
  }
}

Cause	Fix
Header missing	Send `Authorization: Bearer <key>` on every request.
Wrong header format	The scheme is required. `Authorization: <key>` and `X-API-Key` are both rejected.
Key revoked or invalid	Create a new key in the dashboard.
Key belongs to another organization	Use a key issued by the organization that owns the space.

Next steps

Memories API

Store and manage memories.

Retrieve API

Query memories semantically.

API Keys

Create and revoke keys over the API.

Errors

The full error code reference.

Getting Started

API Essentials

Memory (data plane)

LLM Proxy (drop-in)

Account (control plane)

SDKs & MCP

Integrations

Guides

Changelog

Getting a key

Handling keys safely

Organization and space context

Rate limiting

Authentication errors

Next steps

Memories API

Retrieve API

API Keys

Errors

​Getting a key

​Handling keys safely

​Organization and space context

​Rate limiting

​Authentication errors

​Next steps

Memories API

Retrieve API

API Keys

Errors

Getting a key

Handling keys safely

Organization and space context

Rate limiting

Authentication errors

Next steps