Authentication

Project keys

Create and manage keys in the project's API Keys section. Send a key as a bearer credential to the gateway. Keys route calls to the authorized project; capabilities and scope can restrict access.

Authorization: Bearer YOUR_PROJECT_KEY

Never embed a project key in browser JavaScript, a mobile binary, a public repository or a documentation example. Revoke and replace exposed credentials.

Scoped application clients

The TypeScript package is @enkeon/sdk; the factory export remains thinkingroot.

import { thinkingroot } from "@enkeon/sdk";

const client = thinkingroot({
  gatewayUrl: "https://api.enkeon.com",
  projectKey: process.env.ENKEON_API_KEY!,
});
const memory = client.scope(authenticatedUserId);
const hits = await memory.recall("What did this user decide?");

Derive authenticatedUserId on the server from the signed-in session. Do not trust a caller-supplied identifier as authorization.

Console and MCP

Console management requests use the signed-in session. Compatible hosted MCP clients use the OAuth authorization flow; local bridge configurations can use a project key. Follow the MCP setup guide.