Skip to main content
Memory MCP supports two authentication paths:

​
Static agent API keys (desktop)

​
Key format

Send this value in the Authorization header on every request to /v1/mcp/memory, including handshake methods (initialize, tools/list).
Never commit API keys to source control. Rotate immediately if a key is exposed.

​
Generate a key

  1. Open Setup in the PAM app
  2. Choose Desktop app or script
  3. Complete memory source connection and wait for readiness
  4. Click Generate key and copy the full secret immediately
You cannot view the secret again after leaving the page. The dashboard shows only the key prefix until you rotate.

​
One active key per account

Each account has at most one active key at a time. Rotating a key:
  • Issues a new pam_mkey_<key>
  • Revokes the previous key immediately
  • Requires updating your MCP client configuration

​
Rotate or revoke

Both dashboard actions and REST endpoints require your PAM access JWT, not a pam_mkey.

​
Browser OAuth (Claude web & ChatGPT)

Browser connectors do not use pam_mkey. They authenticate with OAuth access tokens after you approve memory:read on the PAM consent screen. Access tokens are short-lived (about 1 hour); compliant clients automatically renew them using a rotating refresh token (about 30 days) via grant_type=refresh_token at POST /v1/oauth/token.
  1. Add your MCP server URL in the browser LLM connector settings (copy from Setup)
  2. Complete OAuth login (PAM opens in your browser if needed)
  3. Click Allow on the consent screen — e.g. “chatgpt.com will be able to read your PAM memory.”
  4. You are redirected back to the browser LLM
Paste only the MCP URL. ChatGPT and Claude discover OAuth via dynamic client registration (DCR):
  • GET /.well-known/oauth-protected-resource
  • GET /.well-known/oauth-authorization-server
  • POST /v1/oauth/register (DCR)
See Client setup for step-by-step ChatGPT and Claude web guides.

​
MCP verified status

Your setup is marked MCP verified only after the first successful retrieve_memory call (isError: false). Blocked calls — quota exceeded, entitlement required, invalid arguments, memory not ready — do not verify the connection.

​
Security practices

  • Store pam_mkey secrets in environment variables or secret managers
  • Rotate keys when team members leave or a key may have been shared
  • Browser OAuth tokens are opaque, scoped to memory:read, and use one-time refresh-token rotation (reuse revokes the whole connection)
  • Revoke a browser connection anytime from Access → Connected apps
  • Cancel on the PAM consent screen returns you to the requesting site without granting access
The static key secret is shown once at issuance or rotation. Browser connectors do not need a pre-issued OAuth client ID.