Security

API keys, sessions, and access controls

API Keys

Security Facts

Passwords

PBKDF2-SHA256, 200k iterations, per-user salt

Sessions

Bearer tokens, 12h TTL, sliding renewal

API keys

rrmc_ prefix, SHA-256 at rest, reveal once, rotate/revoke

Core API

MEM0_API_KEY held server-side only, never sent to browser

Workspace isolation

Namespace resolved server-side; cross-workspace access blocked

Access Control

All permissions are enforced server-side. Hiding a button in the UI is never treated as authorization. Ten canonical roles: platform_admin, org_owner, org_admin, system_admin, data_engineer, steward_admin, reviewer, executive_viewer, member, service_account.