> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runreplay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Replay public API requests with an account API key.

Replay public API requests use API keys. Your key identifies your Replay account and determines which memories the API can return.

## Get an API key

Open the Replay web app and go to your account settings. Create or copy an API key from the API access section.

<Warning>
  Treat your API key like a password. Do not ship it in client-side code, mobile apps, public repositories, or logs.
</Warning>

## Send the key

The recommended format is a bearer token:

```bash theme={null}
curl --request GET \
  --url "$REPLAY_PUBLIC_API_URL/v1/memories" \
  --header "Authorization: Bearer $REPLAY_API_KEY"
```

The API also accepts `X-API-Key`:

```bash theme={null}
curl --request GET \
  --url "$REPLAY_PUBLIC_API_URL/v1/memories" \
  --header "X-API-Key: $REPLAY_API_KEY"
```

## Ownership

You do not pass a `user_id` to the public API. Replay resolves the API key to the account that owns it.

This means:

* `GET /v1/memories` only lists memories for the key owner
* `GET /v1/memories/{memory_id}` only returns the memory if it belongs to the key owner
* A valid key cannot read another account's memories

## Invalid keys

Missing, inactive, or incorrect API keys return `401`.

```json theme={null}
{
  "detail": "Invalid API key"
}
```

## Server-side usage

Use the API from backend jobs, scripts, and agent runtimes where the key can stay private.

```js theme={null}
const response = await fetch(`${process.env.REPLAY_PUBLIC_API_URL}/v1/memories`, {
  headers: {
    Authorization: `Bearer ${process.env.REPLAY_API_KEY}`,
  },
});

const memories = await response.json();
```