Authentication

Every request needs one piece: an API key. The key is the sole identity — your organization is derived server-side from it, and every row is scoped to the calling org.

Get your credentials

Sign in at app.xtrace.ai
Open Settings → API Keys
Create a new API key (xtk_…)

Treat the API key like a password — anyone with it can read and write memories under your org. Store it in a secrets manager or environment variable, never in source control.

Headers

Authorization: Bearer xtk_...

Required on every request. Missing or invalid values:

Error	Cause
`401`	Missing or invalid API key

Upgrading from an older integration? The X-Org-Id header is no longer needed and is deprecated. It’s still accepted during a compatibility window — if sent, it must match the key’s org (a mismatch returns 403 org_mismatch) — but it will be removed in a future release. New integrations must not send it.

Using the SDK

The SDK builds the header from a single constructor option:

import { MemoryClient } from '@xtraceai/memory';

const client = new MemoryClient({
  apiKey: process.env.XTRACE_API_KEY!,
});

That’s it — every method call on the client carries the right headers.

Storing credentials

Never commit API keys to source control. Use environment variables, a secrets manager (AWS Secrets Manager, GCP Secret Manager, 1Password CLI), or a .env file that’s in .gitignore.

A typical setup:

.env

XTRACE_API_KEY=xtk_...

import 'dotenv/config';
import { MemoryClient } from '@xtraceai/memory';

const client = new MemoryClient({
  apiKey: process.env.XTRACE_API_KEY!,
});

Rotating a key

If a key leaks, treat it like any other credential incident:

Issue a new key from your org admin tool
Roll the new key into your environment / secrets manager
Revoke the old key

Keys are long-lived; there is no automatic expiry in v1.

Browser vs server

The SDK works in both Node 18+ and modern browsers (it uses native fetch). Don’t ship API keys to a browser — proxy memory-API calls through your own backend so the key never leaves the server.

Getting started

Guides

Reference

Get your credentials

Headers

Using the SDK

Storing credentials

Rotating a key

Browser vs server

​Get your credentials

​Headers

​Using the SDK

​Storing credentials

​Rotating a key

​Browser vs server

Get your credentials

Headers

Using the SDK

Storing credentials

Rotating a key

Browser vs server