Authentication

Every operation in the published schema accepts one of two authentication methods:

• an API key in the x-api-key header; or
• a JWT in the Authorization: Bearer ... header.

For a new external integration, an API key is usually the better choice. JWTs are primarily useful when an application already participates in the Memo sign-in flow.

Create an API key

1. Sign in to the Memo app.
2. Open Account Settings at /account.
3. Find API for Developers and select Generate Token.
4. Add a description that identifies the integration.
5. Copy the token immediately and store it in a secrets manager.

Memo shows the raw key when it is created and may not show it again. Create separate keys for separate services so you can revoke one integration without affecting another.

Send an API key

curl "https://api.memo.wirewire.de/v1/accounts/current" \
  --header "Accept: application/json" \
  --header "x-api-key: $MEMO_API_KEY"

Use an environment variable locally and a managed secret in deployed services. Never commit a key, print it in logs, put it in a URL, or ship it in browser JavaScript.

Send a bearer token

curl "https://api.memo.wirewire.de/v1/accounts/current" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer $MEMO_ACCESS_TOKEN"

Bearer tokens expire. Your application is responsible for obtaining and refreshing them through its authorized Memo authentication flow.

Authentication and authorization

A valid credential does not grant access to every record. Memo also checks the user's role, requested operation, organization membership, and ownership of related patients or devices.

• 401 Unauthorized means the credential is missing, invalid, or expired.
• 403 Forbidden means the credential is valid but cannot access the requested organization, user, or resource.

Treat an unexpected 403 as a scope or tenant mismatch. Do not work around it by trying IDs from another organization.

Key rotation

Create a replacement key, deploy it, confirm traffic succeeds, and then delete the old key in account settings. Because the public schema does not define a token-rotation endpoint, keep rotation as an intentional account-level operation.