Self-hosted dashboard and admin auth (#4837)

Co-authored-by: kartik-mem0 <kartik.labhshetwar@mem0.ai>
2026-04-23 06:36:36 -07:00
parent 15feaa8ac4
commit db8ac61713
252 changed files with 20275 additions and 331 deletions
@@ -4,6 +4,10 @@ __pycache__/
 *$py.class
 **/node_modules/

+# Self-hosted server local runtime state
+server/history/
+server/.env
+
 # C extensions
 *.so

@@ -15,8 +19,8 @@ dist/
 downloads/
 eggs/
 .eggs/
-lib/
-lib64/
+/lib/
+/lib64/
 parts/
 sdist/
 var/
@@ -1313,7 +1313,7 @@ async def delete_memory(memory_id: str):
 - **Documentation**: https://docs.mem0.ai
 - **GitHub Repository**: https://github.com/mem0ai/mem0
 - **Discord Community**: https://mem0.dev/DiG
- **Platform**: https://app.mem0.ai
+- **Platform**: https://app.mem0.ai?utm_source=oss&utm_medium=llm
 - **Research Paper**: https://mem0.ai/research
 - **Examples**: https://github.com/mem0ai/mem0/tree/main/examples

@@ -85,18 +85,17 @@ See the [migration guide](https://docs.mem0.ai/migration/oss-v2-to-v3) for upgra

 ## 🚀 Quickstart Guide <a name="quickstart"></a>

-Choose between our hosted platform or self-hosted package:
+| | Library | Self-Hosted Server | Cloud Platform |
+|---|---------|-------------------|----------------|
+| **Best for** | Testing, prototyping | Teams running on their own infrastructure | Zero-ops production use |
+| **Setup** | `pip install mem0ai` | `docker compose up` | Sign up at [app.mem0.ai](https://app.mem0.ai?utm_source=oss&utm_medium=readme) |
+| **Dashboard** | -- | [Yes](https://docs.mem0.ai/open-source/setup) | Yes |
+| **Auth & API Keys** | -- | Yes | Yes |
+| **Advanced Features** | -- | Teasers | All included |

-### Hosted Platform
+Just testing? Use the library. Building for a team? Self-hosted. Want zero ops? Cloud.

-Get up and running in minutes with automatic updates, analytics, and enterprise security.
-
-1. Sign up on [Mem0 Platform](https://app.mem0.ai)
-2. Embed the memory layer via SDK or API keys
-
-### Self-Hosted (Open Source)
-
-Install the sdk via pip:
+### Library (pip / npm)

 ```bash
 pip install mem0ai
@@ -110,10 +109,30 @@ python -m spacy download en_core_web_sm
 ```

 Install sdk via npm:
+
 ```bash
 npm install mem0ai
 ```

+### Self-Hosted Server
+
+> **Note:** Self-hosted auth is on by default. Upgrading from a pre-auth build? Set `ADMIN_API_KEY`, register an admin through the wizard, or `AUTH_DISABLED=true` for local dev only. See [upgrade notes](https://docs.mem0.ai/open-source/setup#upgrade-notes).
+
+```bash
+# Recommended: one command — start the stack, create an admin, issue the first API key.
+cd server && make bootstrap
+
+# Manual: start the stack and finish setup via the browser wizard.
+cd server && docker compose up -d    # http://localhost:3000
+```
+
+See the [self-hosted docs](https://docs.mem0.ai/open-source/overview) for configuration.
+
+### Cloud Platform
+
+1. Sign up on [Mem0 Platform](https://app.mem0.ai?utm_source=oss&utm_medium=readme)
+2. Embed the memory layer via SDK or API keys
+
 ### CLI

 Manage memories from your terminal:
@@ -96,7 +96,7 @@ export function printError(message: string, hint?: string): void {
 	const resolvedHint =
 		hint ??
 		(message.includes("Authentication failed")
-			? `Run ${brand("mem0 init")} to reconfigure your API key · https://app.mem0.ai/dashboard/api-keys`
+			? `Run ${brand("mem0 init")} to reconfigure your API key · https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-node`
 			: undefined);
 	if (resolvedHint) {
 		console.error(`  ${dim(resolvedHint)}`);
@@ -185,7 +185,7 @@ function promptLine(label: string, defaultValue?: string): Promise<string> {
 async function setupPlatform(config: Mem0Config): Promise<void> {
 	console.log();
 	console.log(
-		`  ${dim("Get your API key at https://app.mem0.ai/dashboard/api-keys")}`,
+		`  ${dim("Get your API key at https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-node")}`,
 	);
 	console.log();

@@ -234,7 +234,7 @@ async function validatePlatform(config: Mem0Config): Promise<void> {
 		} else {
 			printError(
 				`Could not connect: ${status.error ?? "Unknown error"}`,
-				"Visit https://app.mem0.ai/dashboard/api-keys to get a new key, or run mem0 init again.",
+				"Visit https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-node to get a new key, or run mem0 init again.",
 			);
 		}
 	} catch (e) {
@@ -63,7 +63,7 @@ export async function cmdStatus(
 				`  ${dim("Run")} ${brand("mem0 init")} ${dim("to reconfigure your API key")}`,
 			);
 			lines.push(
-				`  ${dim("Get a key at")} ${brand("https://app.mem0.ai/dashboard/api-keys")}`,
+				`  ${dim("Get a key at")} ${brand("https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-node")}`,
 			);
 		}
 	}
@@ -146,7 +146,7 @@ def timed_status(console: Console, message: str):
            if "Authentication failed" in ctx.error_msg:
                _err.print(
                    f"  [{DIM_COLOR}]Run [bold]mem0 init[/bold] to reconfigure your API key"
-                    f" · [bold]https://app.mem0.ai/dashboard/api-keys[/bold][/]"
+                    f" · [bold]https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-python[/bold][/]"
                )
        raise
    else:
@@ -19,7 +19,13 @@ from mem0_cli.branding import (
    print_info,
    print_success,
 )
-from mem0_cli.config import CONFIG_FILE, DEFAULT_BASE_URL, Mem0Config, load_config, save_config
+from mem0_cli.config import (
+    CONFIG_FILE,
+    DEFAULT_BASE_URL,
+    Mem0Config,
+    load_config,
+    save_config,
+)

 console = Console()
 err_console = Console(stderr=True)
@@ -352,7 +358,9 @@ def run_init(
 def _setup_platform(config: Mem0Config) -> None:
    """Platform setup flow."""
    console.print()
-    console.print(f"  [{DIM_COLOR}]Get your API key at https://app.mem0.ai/dashboard/api-keys[/]")
+    console.print(
+        f"  [{DIM_COLOR}]Get your API key at https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-python[/]"
+    )
    console.print()

    console.print(f"  [{BRAND_COLOR}]API Key[/]: ", end="")
@@ -404,7 +412,7 @@ def _validate_platform(config: Mem0Config) -> None:
            print_error(
                err_console,
                f"Could not connect: {status.get('error', 'Unknown error')}",
-                hint="Visit https://app.mem0.ai/dashboard/api-keys to get a new key, then run mem0 init again.",
+                hint="Visit https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-python to get a new key, then run mem0 init again.",
            )
    except Exception as e:
        print_error(err_console, f"Connection test failed: {e}")
@@ -77,7 +77,7 @@ def cmd_status(
                f"  [{DIM_COLOR}]Run [bold]mem0 init[/bold] to reconfigure your API key[/]"
            )
            lines.append(
-                f"  [{DIM_COLOR}]Get a key at [bold]https://app.mem0.ai/dashboard/api-keys[/bold][/]"
+                f"  [{DIM_COLOR}]Get a key at [bold]https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cli-python[/bold][/]"
            )
    lines.append(f"  [{DIM_COLOR}]Latency:[/]  {_elapsed:.2f}s")

@@ -10,7 +10,7 @@ description: "REST APIs for memory management, search, and entity operations"
 Mem0 provides a comprehensive REST API for integrating advanced memory capabilities into your applications. Create, search, update, and manage memories across users, agents, and custom entities with simple HTTP requests.

 <Info>
-**Quick start:** Get your API key from the <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 Dashboard</a> and make your first memory operation in minutes.
+**Quick start:** Get your API key from the <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=api-reference" rel="nofollow">Mem0 Dashboard</a> and make your first memory operation in minutes.
 </Info>

 ---
@@ -87,7 +87,7 @@ All API requests require authentication using Token-based authentication. Includ
 Authorization: Token <your-api-key>
 ```

-Get your API key from the <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 Dashboard</a>.
+Get your API key from the <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=api-reference" rel="nofollow">Mem0 Dashboard</a>.

 <Warning>
 **Keep your API key secure.** Never expose it in client-side code or public repositories. Use environment variables and server-side requests only.
@@ -45,7 +45,7 @@ Before you begin, follow these steps to set up the demo application:
   OPENAI_API_KEY=your_openai_api_key
   MEM0_API_KEY=your_mem0_api_key
   ```
-   You can obtain your `MEM0_API_KEY` by signing up at <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 API Dashboard</a>.
+   You can obtain your `MEM0_API_KEY` by signing up at <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cookbook-companions-quickstart" rel="nofollow">Mem0 API Dashboard</a>.

 5. Start the development server:
   ```bash
@@ -38,7 +38,7 @@ client = MemoryClient(api_key="your-api-key")
 ```

 <Note>
-Replace `your-api-key` with your actual Mem0 API key from the <a href="https://app.mem0.ai" rel="nofollow">dashboard</a>. Without proper API authentication, memory operations will fail.
+Replace `your-api-key` with your actual Mem0 API key from the <a href="https://app.mem0.ai?utm_source=oss&utm_medium=cookbook-memory-ingestion" rel="nofollow">dashboard</a>. Without proper API authentication, memory operations will fail.
 </Note>

 ---
@@ -17,7 +17,7 @@ from mem0 import MemoryClient
 client = MemoryClient(api_key="m0-...")
 ```

-Grab an API key from the <a href="https://app.mem0.ai/" rel="nofollow">Mem0 dashboard</a> to get started.
+Grab an API key from the <a href="https://app.mem0.ai/?utm_source=oss&utm_medium=cookbook-entity-partitioning" rel="nofollow">Mem0 dashboard</a> to get started.

 ## Store and Retrieve Scoped Memories

@@ -20,7 +20,7 @@ client = MemoryClient(api_key="your-api-key")
 ```

 <Note>
-Your API key needs export permissions to download memory data. Check your project settings on the <a href="https://app.mem0.ai" rel="nofollow">dashboard</a> if export operations fail with authentication errors.
+Your API key needs export permissions to download memory data. Check your project settings on the <a href="https://app.mem0.ai?utm_source=oss&utm_medium=cookbook-exporting-memories" rel="nofollow">dashboard</a> if export operations fail with authentication errors.
 </Note>

 Let's add some sample memories to work with:
@@ -42,7 +42,7 @@ Create a `.env` file in the root of the project and add the following (you can u

 ```bash
 # Mem0 Configuration
-MEM0_API_KEY= # Mem0 API Key (get from https://app.mem0.ai/dashboard/api-keys)
+MEM0_API_KEY= # Mem0 API Key (get from https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cookbook-eliza-os)
 MEM0_USER_ID= # Default: eliza-os-user
 MEM0_PROVIDER= # Default: openai
 MEM0_PROVIDER_API_KEY= # API Key for the provider (OpenAI, Anthropic, etc.)
@@ -55,7 +55,7 @@ GEMINI_API_KEY=your-gemini-api-key-here
 ```

 <Note>
-Ensure you have your Mem0 API key from the <a href="https://app.mem0.ai" rel="nofollow">Mem0 Dashboard</a> and your Gemini API key from the [Google AI Studio](https://ai.studio/app/api-keys).
+Ensure you have your Mem0 API key from the <a href="https://app.mem0.ai?utm_source=oss&utm_medium=cookbook-gemini-3" rel="nofollow">Mem0 Dashboard</a> and your Gemini API key from the [Google AI Studio](https://ai.studio/app/api-keys).
 </Note>

 ## Gemini Memory Agent
@@ -41,7 +41,7 @@ Set up your environment variables:
 - `MEM0_API_KEY`: Your Mem0 Platform API key
 - `OPENAI_API_KEY`: Your OpenAI API key

-You can obtain your Mem0 Platform API key from the <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.
+You can obtain your Mem0 Platform API key from the <a href="https://app.mem0.ai?utm_source=oss&utm_medium=cookbook-llamaindex-multiagent" rel="nofollow">Mem0 Platform</a>.

 ## Complete Implementation

@@ -357,7 +357,7 @@ Based on our previous session, I remember we covered Vision Language Models and
 ## Help & Resources

 - [LlamaIndex Agent Workflows](https://docs.llamaindex.ai/en/stable/use_cases/agents/)
- <a href="https://app.mem0.ai/" rel="nofollow">Mem0 Platform</a>
+- <a href="https://app.mem0.ai/?utm_source=oss&utm_medium=cookbook-llamaindex-multiagent" rel="nofollow">Mem0 Platform</a>

 ---

@@ -25,7 +25,7 @@ os.environ["OPENAI_API_KEY"] = "<your-openai-api-key>"
 llm = OpenAI(model="gpt-5-mini")
 ```

-Initialize the Mem0 client. You can find your API key <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">here</a>. Read about Mem0 [Open Source](https://docs.mem0.ai/open-source/overview).
+Initialize the Mem0 client. You can find your API key <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cookbook-llamaindex-react" rel="nofollow">here</a>. Read about Mem0 [Open Source](https://docs.mem0.ai/open-source/overview).
 ```python
 os.environ["MEM0_API_KEY"] = "<your-mem0-api-key>"

@@ -223,7 +223,7 @@ context = Mem0Context(user_id="user123")
 ## Resources

 - [Mem0 Documentation](https://docs.mem0.ai/introduction)
- <a href="https://app.mem0.ai/dashboard" rel="nofollow">Mem0 Dashboard</a>
+- <a href="https://app.mem0.ai/dashboard?utm_source=oss&utm_medium=cookbook-agents-sdk-tool" rel="nofollow">Mem0 Dashboard</a>
 - [API Reference](https://docs.mem0.ai/api-reference)

 ---
@@ -23,7 +23,7 @@ MEM0_API_KEY=your_mem0_api_key
 OPENAI_API_KEY=your_openai_api_key
 ```

-Get your Mem0 API key from the <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 Dashboard</a>.
+Get your Mem0 API key from the <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=cookbook-openai-tool-calls" rel="nofollow">Mem0 Dashboard</a>.

 ### Configuration

@@ -303,7 +303,7 @@ run().catch(console.error);
 ## Resources

 - [Mem0 Documentation](https://docs.mem0.ai/introduction)
- <a href="https://app.mem0.ai/dashboard" rel="nofollow">Mem0 Dashboard</a>
+- <a href="https://app.mem0.ai/dashboard?utm_source=oss&utm_medium=cookbook-openai-tool-calls" rel="nofollow">Mem0 Dashboard</a>
 - [API Reference](https://docs.mem0.ai/api-reference)
 - [OpenAI Documentation](https://platform.openai.com/docs)

@@ -153,6 +153,7 @@
                    "icon": "rocket",
                    "pages": [
                      "open-source/overview",
+                      "open-source/setup",
                      "vibecoding",
                      "open-source/python-quickstart",
                      "open-source/node-quickstart"
@@ -578,7 +579,7 @@
    "primary": {
      "type": "button",
      "label": "Your Dashboard",
-      "href": "https://app.mem0.ai"
+      "href": "https://app.mem0.ai?utm_source=oss&utm_medium=docs-nav"
    }
  },
  "footer": {
@@ -608,7 +609,7 @@
        "title": "Try in Playground",
        "description": "Open this example in the interactive Mem0 playground",
        "icon": "play",
-        "href": "https://app.mem0.ai/playground"
+        "href": "https://app.mem0.ai/playground?utm_source=oss&utm_medium=docs-nav"
      }
    ]
  },
@@ -24,7 +24,7 @@ pip install mem0ai agentops python-dotenv
 2. Valid API keys:
   - [AgentOps API Key](https://app.agentops.ai/dashboard/api-keys)
   - OpenAI API Key (for LLM operations)
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 API Key</a> (optional, for cloud operations)
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-agentops" rel="nofollow">Mem0 API Key</a> (optional, for cloud operations)

 ## Basic Integration Example

@@ -23,7 +23,7 @@ pip install agno mem0ai python-dotenv
 ```

 2. Valid API keys:
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 API Key</a>
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-agno" rel="nofollow">Mem0 API Key</a>
   - OpenAI API Key (for the agent model)

 ## Quick Integration (Using `Mem0Tools`)
@@ -19,7 +19,7 @@ pip install autogen mem0ai openai python-dotenv

 First, we'll import the necessary libraries and set up our configurations.

-<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.</Note>
+<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-autogen" rel="nofollow">Mem0 Platform</a>.</Note>

 ```python
 import os
@@ -32,7 +32,7 @@ load_dotenv()

 # Configuration
 # OPENAI_API_KEY = 'sk-xxx'  # Replace with your actual OpenAI API key
-# MEM0_API_KEY = 'your-mem0-key'  # Replace with your actual Mem0 API key from https://app.mem0.ai
+# MEM0_API_KEY = 'your-mem0-key'  # Replace with your actual Mem0 API key from https://app.mem0.ai?utm_source=oss&utm_medium=integration-autogen
 USER_ID = "alice"

 # Set up OpenAI API key
@@ -18,7 +18,7 @@ In this guide, you'll:
 - **Python 3.12+**
 - **[uv](https://docs.astral.sh/uv/)** — Python package manager
 - **Node.js 18+** and **npm** — only needed if using the web console
- A **Mem0 API key** from <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a>
+- A **Mem0 API key** from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-chatdev" rel="nofollow">app.mem0.ai</a>
 - An **OpenAI API key** (or another LLM provider supported by ChatDev)

 ## Setup and Configuration
@@ -39,7 +39,7 @@ cd frontend && npm install && cd ..

 Set up your environment variables in a `.env` file:

-<Note>Get your Mem0 API key from <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.</Note>
+<Note>Get your Mem0 API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-chatdev" rel="nofollow">Mem0 Platform</a>.</Note>

 ```bash
 MEM0_API_KEY=your-mem0-api-key
@@ -194,7 +194,7 @@ This means retrieval returns memories from **both** the user's scope and the age

 | Field | Required | Description |
 |-------|----------|-------------|
-| `api_key` | Yes | Mem0 API key from <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a> |
+| `api_key` | Yes | Mem0 API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-chatdev" rel="nofollow">app.mem0.ai</a> |
 | `user_id` | No | Scope memories to a specific user |
 | `agent_id` | No | Scope memories to a specific agent |

@@ -216,9 +216,9 @@ This means retrieval returns memories from **both** the user's scope and the age

 - **No memories returned on first run** — This is expected. Memories are stored *after* the agent responds, so the first interaction has no prior context. Memories appear starting from the second interaction onward.
 - **`mem0ai` not installed** — If you see `ImportError: mem0ai is required for Mem0Memory`, run `uv add mem0ai` or `pip install mem0ai` to add the dependency.
- **Invalid API key** — A wrong or expired `MEM0_API_KEY` will log errors like `Mem0 search failed` or `Mem0 add failed` but won't crash the agent. Check your key at <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a>.
+- **Invalid API key** — A wrong or expired `MEM0_API_KEY` will log errors like `Mem0 search failed` or `Mem0 add failed` but won't crash the agent. Check your key at <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-chatdev" rel="nofollow">app.mem0.ai</a>.
 - **Pipeline headers in memories** — ChatDev automatically strips internal pipeline headers (e.g., `=== INPUT FROM TASK (user) ===`) before sending text to Mem0, so your memories stay clean.
- **Clearing test memories** — To delete memories created during testing, use the Mem0 dashboard at <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a> or the Python SDK: `MemoryClient().delete_all(user_id="your-test-user")`.
+- **Clearing test memories** — To delete memories created during testing, use the Mem0 dashboard at <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-chatdev" rel="nofollow">app.mem0.ai</a> or the Python SDK: `MemoryClient().delete_all(user_id="your-test-user")`.

 ## Key Features

@@ -17,8 +17,8 @@ Add persistent memory to [**Claude Code**](https://docs.anthropic.com/en/docs/cl
 Before setting up Mem0 with Claude Code, ensure you have:

 1. A Mem0 Platform account and API key:
-   - <a href="https://app.mem0.ai" rel="nofollow">Sign up at app.mem0.ai</a>
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Get your API key</a> (starts with `m0-`)
+   - <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-claude-code" rel="nofollow">Sign up at app.mem0.ai</a>
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-claude-code" rel="nofollow">Get your API key</a> (starts with `m0-`)

 2. Claude Code CLI or Claude Cowork desktop app installed

@@ -17,8 +17,8 @@ Add persistent memory to [**OpenAI Codex**](https://openai.com/index/codex/) wit
 Before setting up Mem0 with Codex, ensure you have:

 1. A Mem0 Platform account and API key:
-   - <a href="https://app.mem0.ai" rel="nofollow">Sign up at app.mem0.ai</a>
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Get your API key</a> (starts with `m0-`)
+   - <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-codex" rel="nofollow">Sign up at app.mem0.ai</a>
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-codex" rel="nofollow">Get your API key</a> (starts with `m0-`)

 2. OpenAI Codex access

@@ -22,7 +22,7 @@ pip install crewai crewai-tools mem0ai

 Import required modules and set up configurations:

-<Note>Remember to get your API keys from <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>, [OpenAI](https://platform.openai.com) and [Serper Dev](https://serper.dev) for search capabilities.</Note>
+<Note>Remember to get your API keys from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-crewai" rel="nofollow">Mem0 Platform</a>, [OpenAI](https://platform.openai.com) and [Serper Dev](https://serper.dev) for search capabilities.</Note>

 ```python
 import os
@@ -17,8 +17,8 @@ Add persistent memory to [**Cursor**](https://cursor.com) with the Mem0 plugin.
 Before setting up Mem0 with Cursor, ensure you have:

 1. A Mem0 Platform account and API key:
-   - <a href="https://app.mem0.ai" rel="nofollow">Sign up at app.mem0.ai</a>
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Get your API key</a> (starts with `m0-`)
+   - <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-cursor" rel="nofollow">Sign up at app.mem0.ai</a>
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-cursor" rel="nofollow">Get your API key</a> (starts with `m0-`)

 2. Cursor installed ([cursor.com](https://cursor.com))

@@ -38,7 +38,7 @@ npx flowise start

 ### 2. Obtain Your Mem0 API Key

-1. Navigate to the <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 API Key dashboard</a>.
+1. Navigate to the <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-flowise" rel="nofollow">Mem0 API Key dashboard</a>.
 2. Generate or copy your existing Mem0 API Key.

 ![Mem0 API Key](https://raw.githubusercontent.com/FlowiseAI/FlowiseDocs/main/en/.gitbook/assets/mem0/api-key.png)
@@ -70,7 +70,7 @@ Test your memory configuration:

 1. Save your Flowise configuration
 2. Run a test chat and store some information
-3. Verify the stored memories in the <a href="https://app.mem0.ai/dashboard/requests" rel="nofollow">Mem0 Dashboard</a>
+3. Verify the stored memories in the <a href="https://app.mem0.ai/dashboard/requests?utm_source=oss&utm_medium=integration-flowise" rel="nofollow">Mem0 Dashboard</a>

 ![Flowise Test Chat](https://raw.githubusercontent.com/FlowiseAI/FlowiseDocs/main/en/.gitbook/assets/mem0/flowise-chat-1.png)

@@ -103,7 +103,7 @@ Available settings include:

 ### Platform Configuration

-Additional settings available in <a href="https://app.mem0.ai/dashboard/project-settings" rel="nofollow">Mem0 Project Settings</a>:
+Additional settings available in <a href="https://app.mem0.ai/dashboard/project-settings?utm_source=oss&utm_medium=integration-flowise" rel="nofollow">Mem0 Project Settings</a>:

 1. **Custom Instructions**: Define memory extraction rules
 2. **Expiration Date**: Set automatic memory cleanup periods
@@ -22,7 +22,7 @@ pip install google-adk mem0ai python-dotenv
 ```

 2. Valid API keys:
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 API Key</a>
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-google-ai-adk" rel="nofollow">Mem0 API Key</a>
   - Google AI Studio API Key

 ## Basic Integration Example
@@ -52,7 +52,7 @@ hermes memory setup

 Select **mem0** as the provider and enter your Mem0 API key when prompted. The wizard writes your config to `~/.hermes/mem0.json`.

-<Note>Get your API key from <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a>.</Note>
+<Note>Get your API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-hermes" rel="nofollow">app.mem0.ai</a>.</Note>

 ### Option 2: Manual Configuration

@@ -16,7 +16,7 @@ Combining Mem0 with Keywords AI allows you to:
 4. Optimize token usage and reduce costs

 <Note>
-You can get your Mem0 API key from the <a href="https://app.mem0.ai/" rel="nofollow">Mem0 dashboard</a>.
+You can get your Mem0 API key from the <a href="https://app.mem0.ai/?utm_source=oss&utm_medium=integration-keywords" rel="nofollow">Mem0 dashboard</a>.
 </Note>

 ## Setup and Configuration
@@ -22,7 +22,7 @@ pip install langchain langchain_openai mem0ai python-dotenv

 Import required modules and set up configurations:

-<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.</Note>
+<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-langchain" rel="nofollow">Mem0 Platform</a>.</Note>

 ```python
 import os
@@ -23,7 +23,7 @@ pip install langgraph langchain-openai mem0ai python-dotenv

 Import required modules and set up configurations:

-<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.</Note>
+<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-langgraph" rel="nofollow">Mem0 Platform</a>.</Note>

 ```python
 from typing import Annotated, TypedDict, List
@@ -22,7 +22,7 @@ pip install llama-index-core llama-index-memory-mem0 python-dotenv
 Set your Mem0 Platform API key as an environment variable. You can replace `<your-mem0-api-key>` with your actual API key:

 <Note type="info">
-  You can obtain your Mem0 Platform API key from the <a href="https://app.mem0.ai/login" rel="nofollow">Mem0 Platform</a>.
+  You can obtain your Mem0 Platform API key from the <a href="https://app.mem0.ai/login?utm_source=oss&utm_medium=integration-llama-index" rel="nofollow">Mem0 Platform</a>.
 </Note>

 ```python
@@ -23,7 +23,7 @@ npm install @mastra/core @mastra/mem0 @ai-sdk/openai zod

 Set up your environment variables:

-<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.</Note>
+<Note>Remember to get the Mem0 API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-mastra" rel="nofollow">Mem0 Platform</a>.</Note>

 ```bash
 MEM0_API_KEY=your-mem0-api-key
@@ -22,7 +22,7 @@ pip install openai-agents mem0ai
 ```

 2. Valid API keys:
-   - <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 API Key</a>
+   - <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-openai-agents-sdk" rel="nofollow">Mem0 API Key</a>
   - [OpenAI API Key](https://platform.openai.com/api-keys)

 ## Basic Integration Example
@@ -114,7 +114,7 @@ That's it. No API key, no config file editing, no environment variables. The plu
  </Step>

  <Step title="Get your API key">
-    Get your API key from <a href="https://app.mem0.ai?utm_source=mem0-docs" rel="nofollow">app.mem0.ai</a>.
+    Get your API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-openclaw" rel="nofollow">app.mem0.ai</a>.
  </Step>

  <Step title="Select the plugin as your memory backend in `openclaw.json`">
@@ -9,7 +9,7 @@ Mem0 is a self-improving memory layer for LLM applications, enabling personalize

 **Get your API Key**: You'll need a Mem0 API key to use this extension:

-a. Sign up at <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a>
+a. Sign up at <a href="https://app.mem0.ai?utm_source=oss&utm_medium=integration-raycast" rel="nofollow">app.mem0.ai</a>

 b. Navigate to your API Keys page

@@ -29,7 +29,7 @@ npm install @mem0/vercel-ai-provider

 ### Setting Up Mem0

-1. Get your **Mem0 API Key** from the <a href="https://app.mem0.ai/dashboard/api-keys" rel="nofollow">Mem0 Dashboard</a>.
+1. Get your **Mem0 API Key** from the <a href="https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=integration-vercel-ai-sdk" rel="nofollow">Mem0 Dashboard</a>.

 2. Initialize the Mem0 Client in your application:

@@ -161,6 +161,7 @@ If the user is on a pre-current major (Python < 2, TS < 3, or Platform `output_f
 - [Open Source Configuration](https://docs.mem0.ai/open-source/configuration) [OSS]: Use when configuring `Memory` - LLM, embedder, vector store, graph store.
 - [Open Source Python Quickstart](https://docs.mem0.ai/open-source/python-quickstart) [OSS]: Use for the first self-hosted Python integration.
 - [Open Source Node.js Quickstart](https://docs.mem0.ai/open-source/node-quickstart) [OSS]: Use for the first self-hosted Node integration.
+- [Self-Hosted Setup](https://docs.mem0.ai/open-source/setup) [OSS]: Use when standing up the bundled REST server and dashboard via Docker Compose, including auth, API keys, and the setup wizard.

 ## Core Concepts

@@ -28,7 +28,7 @@ Move your Mem0 implementation to managed infrastructure with enterprise features

 ## Plan

-1. **Sign up**: Create an account on <a href="https://app.mem0.ai" rel="nofollow">Mem0 Platform</a>.
+1. **Sign up**: Create an account on <a href="https://app.mem0.ai?utm_source=oss&utm_medium=migration-oss-to-platform" rel="nofollow">Mem0 Platform</a>.
 2. **Get API Key**: Navigate to **Settings > API Keys** and generate a new key.
 3. **Review Usage**: Identify where you instantiate `Memory` and where you call `search` or `get_all`.

@@ -372,7 +372,7 @@ If you encounter issues, you can revert immediately by switching your import bac

 ## Next Steps

- <a href="https://app.mem0.ai" rel="nofollow">Platform Dashboard</a> - Monitor usage and manage settings.
+- <a href="https://app.mem0.ai?utm_source=oss&utm_medium=migration-oss-to-platform" rel="nofollow">Platform Dashboard</a> - Monitor usage and manage settings.
 - [Webhooks Setup](/platform/features/webhooks) - Configure real-time event notifications.
 - [Organizations & Projects](/api-reference/organizations-projects) - Set up multi-tenancy for your team.

@@ -13,6 +13,10 @@ The Mem0 REST API server exposes every OSS memory operation over HTTP. Run it al
  - You plan to explore or debug endpoints through the built-in OpenAPI page at `/docs`.
 </Info>

+<Warning>
+  **First time self-hosting, or upgrading from a pre-1.x build?** Start at [Self-Hosted Setup](/open-source/setup). It walks through the stack, the setup wizard, and the upgrade path for deployments that relied on open endpoints or `ADMIN_API_KEY`. This page covers the API surface and auth modes only.
+</Warning>
+
 <Warning>
  **OSS vs Platform API paths:** The self-hosted OSS server does **not** use the `/v1/` prefix. For example, the endpoint is `POST /memories`, not `POST /v1/memories/`. The [API Reference](/api-reference) documents the hosted platform at `api.mem0.ai` which uses `/v1/` paths — those do not apply to the OSS server.
 </Warning>
@@ -26,7 +30,7 @@ The Mem0 REST API server exposes every OSS memory operation over HTTP. Run it al
 ## Feature

 - **CRUD endpoints:** Create, retrieve, search, update, delete, and reset memories by `user_id`, `agent_id`, or `run_id`.
- **API key authentication:** Optionally secure all endpoints with a shared API key via the `X-API-Key` header.
+- **Authentication:** On by default. Dashboard sessions use JWTs; programmatic clients use per-user `X-API-Key` headers. Legacy `ADMIN_API_KEY` is still supported.
 - **Status health check:** Access base routes to confirm the server is online.
 - **OpenAPI explorer:** Visit `/docs` for interactive testing and schema reference.

@@ -42,20 +46,30 @@ The Mem0 REST API server exposes every OSS memory operation over HTTP. Run it al

    ```bash
    OPENAI_API_KEY=your-openai-api-key
+    JWT_SECRET=$(openssl rand -base64 48)
    ```

-2. Start the stack:
+2. Bootstrap the stack in one command:

    ```bash
    cd server
-docker compose up
+    make bootstrap    # starts Compose, creates an admin, issues the first API key
    ```

-3. Reach the API at `http://localhost:8888`. Edits to the server or library auto-reload.
+    Or to start the stack only and finish setup via the browser wizard at http://localhost:3000:
+
+    ```bash
+    cd server
+    docker compose up -d
+    ```
+
+3. API is at `http://localhost:8888`. Code edits auto-reload.
  </Tab>
 </Tabs>

-### Run with Docker
+<AccordionGroup>
+  <Accordion title="Other install paths">
+    **Run with Docker**

    <Tabs>
      <Tab title="Pull image">
@@ -70,7 +84,7 @@ docker build -t mem0-api-server .
      </Tab>
    </Tabs>

-1. Create a `.env` file with `OPENAI_API_KEY`.  
+    1. Create a `.env` file with `OPENAI_API_KEY` and `JWT_SECRET`.
    2. Run the container:

    ```bash
@@ -79,12 +93,26 @@ docker run -p 8000:8000 --env-file .env mem0-api-server

    3. Visit `http://localhost:8000`.

-### Run directly (no Docker)
+    **Run directly (no Docker)**
+
+    <Warning>
+      This path skips Docker and assumes Postgres is already running and reachable at `POSTGRES_HOST:POSTGRES_PORT`. For a single-command local setup with Postgres included, use Docker Compose above.
+    </Warning>

    ```bash
    pip install -r requirements.txt
    uvicorn main:app --reload
    ```
+  </Accordion>
+</AccordionGroup>
+
+<Note>
+  Compose publishes internal port 8000 as 8888 on the host. Raw Docker and raw uvicorn listen on 8000 unless remapped.
+</Note>
+
+<Note>
+  `JWT_SECRET` is required once auth is enabled — the server returns `500` on auth endpoints if it's unset. Generate one with `openssl rand -base64 48`. See [Self-Hosted Setup](/open-source/setup#configure-the-environment) for the full env var table.
+</Note>

 <Tip>
  Use a process manager such as `systemd`, Supervisor, or PM2 when deploying the FastAPI server for production resilience.
@@ -98,35 +126,74 @@ uvicorn main:app --reload

 ## Authentication

-The server supports optional API key authentication. When the `ADMIN_API_KEY` environment variable is set, every endpoint requires a valid `X-API-Key` header. The `/` redirect, `/docs`, and `/openapi.json` routes remain open so you can always reach the interactive API explorer.
+Auth is on by default. Protected endpoints require either a JWT (from the dashboard login flow) or an `X-API-Key` header. The `/` redirect, `/docs`, and `/openapi.json` routes stay open so you can reach the OpenAPI explorer.

-| `ADMIN_API_KEY` value | Behavior |
-|---|---|
-| Not set / empty | All endpoints are open (no auth) |
-| Any non-empty string | Requests must include `X-API-Key: <your-key>` |
+| Mode | How to send it | When to use it |
+|---|---|---|
+| Bearer JWT | `Authorization: Bearer <access_token>` | Dashboard sessions; tokens come from `POST /auth/login` and refresh via `POST /auth/refresh` |
+| Per-user API key | `X-API-Key: m0sk_...` | Programmatic access scoped to a single dashboard user |
+| Legacy `ADMIN_API_KEY` | `X-API-Key: <env value>` | Back-compat for deployments that set the `ADMIN_API_KEY` env var |
+| `AUTH_DISABLED=true` | — | Local development only; bypasses auth entirely |

-### Enable authentication
+The `/docs` OpenAPI explorer supports both auth modes. Click **Authorize** at the top of the page and paste either `Bearer <access_token>` (JWT) or your `X-API-Key` value. Protected endpoints return `401` until you authorize.

-Add the key to your `.env` file:
+### Log in and use a JWT
+
+Register the first admin (only works when no user exists yet), then log in:

 ```bash
-ADMIN_API_KEY=your-secret-api-key
+# First admin only — returns 403 after the first admin is registered
+curl -X POST http://localhost:8888/auth/register \
+  -H "Content-Type: application/json" \
+  -d '{"name": "Admin", "email": "admin@example.com", "password": "strong-password"}'
 ```

-Then include the header in every request:
+```bash
+curl -X POST http://localhost:8888/auth/login \
+  -H "Content-Type: application/json" \
+  -d '{"email": "admin@example.com", "password": "your-password"}'
+```
+
+Use the returned `access_token` as a bearer token:

 ```bash
-curl -X POST http://localhost:8000/memories \
+curl -X POST http://localhost:8888/memories \
  -H "Content-Type: application/json" \
-  -H "X-API-Key: your-secret-api-key" \
+  -H "Authorization: Bearer <access_token>" \
  -d '{
    "messages": [{"role": "user", "content": "I love pizza."}],
    "user_id": "alice"
  }'
 ```

+When the access token expires, exchange the refresh token at `POST /auth/refresh`.
+
+### Create and use a per-user API key
+
+Create a key from the dashboard **API Keys** page, or call `POST /api-keys` with a JWT. The full `m0sk_...` value is returned **once** at creation time — store it securely.
+
+```bash
+curl -X POST http://localhost:8888/memories \
+  -H "Content-Type: application/json" \
+  -H "X-API-Key: m0sk_your_key_here" \
+  -d '{
+    "messages": [{"role": "user", "content": "I love pizza."}],
+    "user_id": "alice"
+  }'
+```
+
+Per-user keys inherit the creating user's scope. List or revoke them via `GET /api-keys` and `DELETE /api-keys/{id}`.
+
+### Legacy `ADMIN_API_KEY`
+
+Set the `ADMIN_API_KEY` environment variable and send it as `X-API-Key`. The request is treated as admin-level and is not tied to a dashboard user. This mode is kept for back-compat with older self-hosted deployments — prefer JWT or per-user keys for new setups.
+
+```bash
+ADMIN_API_KEY=your-long-admin-key
+```
+
 <Warning>
-  The server logs a warning at startup when `ADMIN_API_KEY` is not set. Always set it in production.
+  Setting `AUTH_DISABLED=true` makes every protected endpoint open — the server logs a warning at startup when it's enabled. The server also warns when `ADMIN_API_KEY` is shorter than 16 characters. Never enable `AUTH_DISABLED` in production, and always use a long `ADMIN_API_KEY` if you rely on the legacy fallback.
 </Warning>

 ---
@@ -136,7 +203,7 @@ curl -X POST http://localhost:8000/memories \
 ### Create and search memories via HTTP

 ```bash
-curl -X POST http://localhost:8000/memories \
+curl -X POST http://localhost:8888/memories \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
@@ -151,7 +218,7 @@ curl -X POST http://localhost:8000/memories \
 </Info>

 ```bash
-curl -X POST http://localhost:8000/search \
+curl -X POST http://localhost:8888/search \
  -H "Content-Type: application/json" \
  -d '{
    "query": "vegetable",
@@ -161,7 +228,7 @@ curl -X POST http://localhost:8000/search \

 ### Explore with OpenAPI docs

-1. Navigate to `http://localhost:8000/docs`.
+1. Navigate to `http://localhost:8888/docs` (Compose) or `http://localhost:8000/docs` (raw Docker / uvicorn).
 2. Pick an endpoint (e.g., `POST /search`).  
 3. Fill in parameters and click **Execute** to try requests in-browser.

@@ -175,9 +242,13 @@ curl -X POST http://localhost:8000/search \

 The OSS REST server exposes the following endpoints. None use the `/v1/` prefix.

+### Memory operations
+
 | Method | Path | Description |
 |--------|------|-------------|
-| `POST` | `/configure` | Set memory configuration |
+| `POST` | `/configure` | Set memory configuration. Rejects unbundled providers with a 400 |
+| `GET` | `/configure` | Get the current memory configuration |
+| `GET` | `/configure/providers` | List the LLM and embedder providers bundled in the container |
 | `POST` | `/memories` | Create memories |
 | `GET` | `/memories` | Get all memories (filter by `user_id`, `agent_id`, or `run_id`) |
 | `GET` | `/memories/{memory_id}` | Get a specific memory |
@@ -188,6 +259,43 @@ The OSS REST server exposes the following endpoints. None use the `/v1/` prefix.
 | `POST` | `/search` | Search memories |
 | `POST` | `/reset` | Reset all memories |

+### Authentication
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/auth/setup-status` | Returns `{needsSetup: bool}`. Open, no auth required |
+| `POST` | `/auth/register` | Register the first admin. Registration closes after the first admin is created; additional accounts are provisioned by the existing admin. |
+| `POST` | `/auth/login` | Exchange email and password for access and refresh JWTs |
+| `POST` | `/auth/refresh` | Exchange a refresh token for a new access token |
+| `GET` | `/auth/me` | Get the current authenticated user (JWT required) |
+| `PATCH` | `/auth/me` | Update the caller's name or email. 409 if the new email is already in use |
+| `POST` | `/auth/change-password` | Change the caller's password. 401 if the current password is wrong; new password must be at least 8 characters |
+
+### API keys
+
+All `/api-keys` endpoints require a JWT.
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/api-keys` | List the caller's API keys |
+| `POST` | `/api-keys` | Create a new key; the full `m0sk_...` value is returned once |
+| `DELETE` | `/api-keys/{id}` | Revoke an API key |
+
+### Request logs
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/requests?limit=N` | Recent API call log (JWT or admin key) |
+
+### Entities
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/entities` | Distinct `user_id` / `agent_id` / `run_id` values with memory counts |
+| `DELETE` | `/entities/{entity_type}/{entity_id}` | Cascade-delete all memories for an entity; `entity_type` is `user`, `agent`, or `run` |
+
+The `/auth/*`, `/api-keys`, `/requests`, and `/entities` routes are new to the self-hosted server and primarily back the dashboard, but you can call them directly from your own tooling.
+
 ---

 ## Verify the feature is working
@@ -201,7 +309,7 @@ The OSS REST server exposes the following endpoints. None use the `/v1/` prefix.

 ## Best practices

-1. **Enable authentication:** Set `ADMIN_API_KEY` to secure all endpoints, or use an API gateway for more advanced schemes.
+1. **Keep auth on:** Auth is enabled by default. Never set `AUTH_DISABLED=true` in production. If you rely on `ADMIN_API_KEY`, use a long value (16+ chars) or prefer per-user API keys.
 2. **Use HTTPS:** Terminate TLS at your load balancer or reverse proxy.
 3. **Monitor uptime:** Track request rates, latency, and error codes per endpoint.
 4. **Version configs:** Keep environment files and Docker Compose definitions in source control.
@@ -15,12 +15,15 @@ Mem0 Open Source delivers the same adaptive memory engine as the platform, but p
 - **Extendable codebase**: Fork the repo, add providers, and ship custom automations.

 <Info>
-  Begin with the <Link href="/open-source/python-quickstart">Python quickstart</Link> (or the Node.js variant) to clone the repo, configure dependencies, and validate memory reads/writes locally.
+  Two ways to run Mem0 OSS: as a **library** inside your app (Python or Node), or as a **self-hosted server** with a dashboard, per-user API keys, and a request audit log.
 </Info>

 ## Choose your path

-<CardGroup cols={2}>
+<CardGroup cols={3}>
+  <Card title="Self-hosted setup" icon="rocket-launch" href="/open-source/setup">
+    Run `make bootstrap` to launch the server + dashboard, create an admin, and issue your first API key.
+  </Card>
  <Card title="Python Quickstart" icon="python" href="/open-source/python-quickstart">
    Bootstrap CLI and verify add/search loop.
  </Card>
@@ -41,15 +44,6 @@ Mem0 Open Source delivers the same adaptive memory engine as the platform, but p
  </Card>
 </CardGroup>

-<CardGroup cols={2}>
-  <Card title="Deploy with Docker Compose" icon="server" href="/open-source/features/rest-api">
-    Reference deployment with REST endpoints.
-  </Card>
-  <Card title="Use the REST API" icon="code" href="/open-source/features/rest-api">
-    Async add/search flows and automation.
-  </Card>
-</CardGroup>
-
 <Tip>
  Need a managed alternative? Compare hosting models in the <Link href="/platform/platform-vs-oss">Platform vs OSS guide</Link> or switch tabs to the Platform documentation.
 </Tip>
@@ -70,19 +64,27 @@ Mem0 Open Source delivers the same adaptive memory engine as the platform, but p
 ## Default components

 <Note>
-  Mem0 OSS works out of the box with sensible defaults:
+  **Library defaults** (when you `import` Mem0 and call `Memory()` directly):
  - LLM: OpenAI `gpt-5-mini` (via `OPENAI_API_KEY`)
  - Embeddings: OpenAI `text-embedding-3-small`
-  - Vector store: Local Qdrant instance storing data at `/tmp/qdrant`
-  - History store: SQLite database at `~/.mem0/history.db`
-  - Reranker: Disabled until you configure a provider
+  - Vector store: Local Qdrant at `/tmp/qdrant`
+  - History store: SQLite at `~/.mem0/history.db`
+  - Reranker: Disabled until configured

  Override any component with <Link href="/open-source/configuration">`Memory.from_config`</Link>.
 </Note>

-## Keep going
+<Note>
+  **Self-hosted server defaults** (the `server/` Docker Compose stack):
+  - LLM: OpenAI `gpt-4.1-nano-2025-04-14` (override with `MEM0_DEFAULT_LLM_MODEL`)
+  - Embeddings: OpenAI `text-embedding-3-small` (override with `MEM0_DEFAULT_EMBEDDER_MODEL`)
+  - Vector store: Postgres + pgvector
+  - Bundled providers: `openai`, `anthropic`, `gemini` — switch from the Configuration page

-{/* DEBUG: verify CTA targets */}
+  See <Link href="/open-source/setup#supported-providers">Self-Hosted Setup</Link> for the full provider list and how to extend it.
+</Note>
+
+## Keep going

 <CardGroup cols={2}>
  <Card
@@ -98,7 +100,3 @@ Mem0 Open Source delivers the same adaptive memory engine as the platform, but p
    href="/open-source/python-quickstart"
  />
 </CardGroup>
-
-<Tip>
-  Need a managed alternative? Compare hosting models in the <Link href="/platform/platform-vs-oss">Platform vs OSS guide</Link> or switch tabs to the Platform documentation.
-</Tip>
@@ -0,0 +1,218 @@
+---
+title: "Self-Hosted Setup"
+description: "Stand up the Mem0 REST server and dashboard in a few minutes — admin account, API keys, and a live audit log included."
+icon: "rocket-launch"
+---
+
+The self-hosted bundle ships the REST API and a web dashboard together. Configure your LLM provider and secrets in a `.env` file, start the containers, then choose how to create your admin account: through the browser-based setup wizard, or from the command line.
+
+<Info>
+  **Use this page when…**
+  - You want a self-hosted Mem0 with a dashboard, not just the Python or Node library.
+  - You need per-user API keys and a request audit log for your team.
+  - You're upgrading from a pre-1.x server that relied on `ADMIN_API_KEY` or open endpoints.
+</Info>
+
+<Warning>
+  **Upgrading from 1.x?** Auth is now on by default. Deployments that ran with an empty `ADMIN_API_KEY` will return `401` on every protected endpoint until you either set `ADMIN_API_KEY`, register an admin through the wizard, or set `AUTH_DISABLED=true` for local development. See [Upgrade notes](#upgrade-notes) below.
+</Warning>
+
+---
+
+## Prerequisites
+
+- Docker and Docker Compose (the reference path).
+- An `OPENAI_API_KEY` (or equivalent — the server reads the same component config as the library).
+- A free port `8888` for the API and `3000` for the dashboard.
+
+---
+
+## Configure the environment
+
+Copy `server/.env.example` to `server/.env` and fill in the required values. The server refuses to start if `JWT_SECRET` is unset once auth is enabled.
+
+| Variable | Required | Purpose |
+|---|---|---|
+| `OPENAI_API_KEY` | Yes | Default LLM and embedder provider. |
+| `JWT_SECRET` | Yes | Signs access and refresh tokens. Use a long random value. A missing secret causes auth endpoints to return `500`. |
+| `ADMIN_API_KEY` | Optional | Legacy shared admin key. Kept for back-compat; prefer per-user keys for new setups. |
+| `AUTH_DISABLED` | Optional | `true` turns off auth for local development only. Never enable in production. |
+| `DASHBOARD_URL` | Optional | Origin the API accepts for CORS. Defaults to `http://localhost:3000`. Set this when you front the dashboard on a custom domain. |
+| `POSTGRES_*` | Optional | Override the bundled Postgres / pgvector connection. |
+
+<Tip>
+  Generate a `JWT_SECRET` with `openssl rand -base64 48` or `python -c "import secrets; print(secrets.token_urlsafe(48))"`.
+</Tip>
+
+---
+
+## Start the stack
+
+Pick the path that fits your workflow.
+
+### Browser-first (setup wizard)
+
+```bash
+cd server
+make up
+```
+
+This starts the containers and runs database migrations. The REST API listens on `http://localhost:8888` and the dashboard on `http://localhost:3000`.
+
+Open `http://localhost:3000` — since no admin account exists yet, the dashboard redirects to the one-time setup wizard at `/setup`. See [Run the setup wizard](#run-the-setup-wizard) below.
+
+### Agent-first (command line)
+
+First, set `OPENAI_API_KEY` (or `ANTHROPIC_API_KEY` / `GOOGLE_API_KEY`) in `server/.env`. `make bootstrap` does not prompt for it, and the runtime test will fail without a valid provider key.
+
+```bash
+cd server
+make bootstrap
+```
+
+`make bootstrap` starts the same containers, then automatically creates the admin account and generates the first API key via the CLI. The admin credentials and API key are printed to your terminal — no browser required.
+
+You can override the generated credentials:
+
+```bash
+make bootstrap EMAIL=admin@company.com PASSWORD='strong-password' NAME='Admin'
+```
+
+Because `make bootstrap` already creates the admin, the setup wizard is skipped. Opening `http://localhost:3000` takes you straight to the login page.
+
+<Tip>
+  For machine-readable output (useful in CI), run `OUTPUT=json make seed` after `make up`.
+</Tip>
+
+---
+
+## Run the setup wizard
+
+<Info>
+  This section applies to the **browser-first** path (`make up`). If you used `make bootstrap`, the admin and API key were already created — skip ahead to [What the dashboard gives you](#what-the-dashboard-gives-you).
+</Info>
+
+On a fresh install the dashboard redirects to `/setup`. Each step submits on Enter.
+
+**1. Create the admin account.** Name, email, password. This account becomes the first admin. Registration closes after the first admin is created; additional accounts are provisioned by the existing admin.
+
+**2. Review the effective config.** Read-only display of the LLM and embedder the server is running with, sourced from your environment. If anything is wrong here, stop the stack, fix the `.env`, and restart — the dashboard intentionally does not let you change provider secrets at runtime.
+
+**3. Generate your first API key.** The full `m0sk_...` value is shown **once**. Copy it immediately — the server only stores the prefix and a bcrypt hash.
+
+**4. Tell us your use case.** Pick a preset or describe your use case in a few words. Mem0 generates custom instructions that tell the memory system what to prioritize. You can edit the instructions before saving, or skip this step entirely.
+
+**5. Test the key.** A ready-to-paste `curl` exercises `POST /memories` against your new key. Click "Run Test" to fire it from the browser. Success lands you in the dashboard at `/dashboard/requests`, where you'll see the test call in the live audit log.
+
+---
+
+## What the dashboard gives you
+
+| Page | What it does |
+|---|---|
+| **Requests** | Default landing page. Live audit log of every API call, with status, latency, and auth mode. |
+| **Memories** | Browse and search the memories your server has stored. |
+| **Entities** | Distinct `user_id` / `agent_id` / `run_id` values with memory counts and cascade-delete. |
+| **API Keys** | Issue per-user keys, label them, and revoke. |
+| **Configuration** | Runtime override for LLM and embedder. Changes persist to the app database and reapply on restart, layered over the values from your `.env`. |
+| **Settings** | Account and session controls. |
+
+For the underlying endpoints (including `/auth/*`, `/api-keys`, `/requests`, `/entities`), see the [REST API reference](/open-source/features/rest-api).
+
+---
+
+## Supported providers
+
+The shipped container bundles the Python packages for:
+
+- **LLMs** — `openai`, `anthropic`, `gemini`
+- **Embedders** — `openai`, `gemini`
+
+The Configuration page and `POST /configure` only accept providers from these lists. Anything else returns a 400 up front instead of failing at the first memory write.
+
+**To add another provider**, for example to run embeddings locally with `sentence-transformers`:
+
+1. Add the package to `server/requirements.txt` (e.g. `sentence-transformers>=2.0`).
+2. Extend `BUNDLED_LLM_PROVIDERS` or `BUNDLED_EMBEDDER_PROVIDERS` in `server/main.py`.
+3. Rebuild the image (`make up` or `docker compose build`).
+
+Heavy providers (`sentence-transformers` pulls in PyTorch, ~2 GB) are intentionally kept out of the default image.
+
+---
+
+## Upgrade notes
+
+### Upgrading from a pre-auth build
+
+Previous self-hosted builds allowed open access when `ADMIN_API_KEY` was unset. This build enables auth by default. After pulling the new image, pick **one**:
+
+1. **Fastest, zero client changes** — set `ADMIN_API_KEY` to a long random value (16+ characters). Existing clients that send `X-API-Key: <your-key>` keep working unchanged.
+2. **Recommended for teams** — visit `http://<host>:3000`, run the setup wizard, and switch clients to per-user API keys. You get the audit log and revocation for free.
+3. **Local development only** — set `AUTH_DISABLED=true`. The server logs a warning on every boot. Never use this in production.
+
+The server prints an unmissable startup banner when it detects the "upgraded but not configured" state so you know exactly which option to pick.
+
+### Other changes in this release
+
+- Dashboard ships as a second container in the reference Compose stack, wired to the API over the internal Docker network.
+- New tables: `users`, `api_keys`, `request_logs`. Alembic handles the migration automatically on first boot.
+
+If `alembic upgrade head` fails on first boot, see the [Troubleshooting](#troubleshooting) section below.
+
+---
+
+## Troubleshooting
+
+<AccordionGroup>
+  <Accordion title="Port 3000 or 8888 is already in use">
+    Find the owning process on either port:
+    ```bash
+    lsof -iTCP:3000 -sTCP:LISTEN
+    lsof -iTCP:8888 -sTCP:LISTEN
+    ```
+    Kill it (`kill <PID>`) or change the host port in `server/docker-compose.yaml`.
+  </Accordion>
+
+  <Accordion title="JWT_SECRET is required">
+    The server refuses to start without one. Generate a secret and add it to `server/.env`:
+    ```bash
+    echo "JWT_SECRET=$(openssl rand -base64 48)" >> server/.env
+    ```
+    `AUTH_DISABLED=true` is valid for local dev only, never production.
+  </Accordion>
+
+  <Accordion title=".env changes aren't applied after editing">
+    `docker compose restart` does not re-read `env_file`. To pick up changes:
+    ```bash
+    cd server && docker compose up -d --force-recreate mem0
+    # or
+    cd server && make up
+    ```
+  </Accordion>
+
+  <Accordion title="Provider returns 401 (bad API key)">
+    Provider credential errors surface as `502 Upstream provider error.`. Check `docker compose logs mem0` for the full trace, then fix the key on the Configuration page and hit **Save**.
+  </Accordion>
+
+  <Accordion title="Alembic migrations fail on startup">
+    Inspect the logs:
+    ```bash
+    docker compose logs mem0 | grep -i alembic
+    ```
+    If the database is unrecoverable, reset the volume (**this destroys all memories and users**):
+    ```bash
+    docker compose down -v
+    ```
+  </Accordion>
+</AccordionGroup>
+
+---
+
+<CardGroup cols={2}>
+  <Card title="REST API reference" icon="code" href="/open-source/features/rest-api">
+    Endpoint tables, auth modes, and example requests.
+  </Card>
+  <Card title="Configure components" icon="sliders" href="/open-source/configuration">
+    Swap LLMs, embedders, vector stores, and rerankers.
+  </Card>
+</CardGroup>
@@ -7,8 +7,8 @@ estimatedTime: "~2 minutes"

 <Info>
  **Prerequisites**
-  - Mem0 Platform account (<a href="https://app.mem0.ai" rel="nofollow">Sign up here</a>)
-  - API key (<a href="https://app.mem0.ai/settings/api-keys" rel="nofollow">Get one from dashboard</a>)
+  - Mem0 Platform account (<a href="https://app.mem0.ai?utm_source=oss&utm_medium=platform-mem0-mcp" rel="nofollow">Sign up here</a>)
+  - API key (<a href="https://app.mem0.ai/settings/api-keys?utm_source=oss&utm_medium=platform-mem0-mcp" rel="nofollow">Get one from dashboard</a>)
  - Node.js 14+ (for npx)
  - An MCP-compatible client (Claude, Claude Code, Cursor, Windsurf, VS Code, OpenCode)
 </Info>
@@ -163,7 +163,7 @@ Agent: Updated your project status successfully.
 ```

 <Info icon="check">
-  If you get "Connection failed", ensure you have a valid API key from <a href="https://app.mem0.ai/settings/api-keys" rel="nofollow">Mem0 Dashboard</a>.
+  If you get "Connection failed", ensure you have a valid API key from <a href="https://app.mem0.ai/settings/api-keys?utm_source=oss&utm_medium=platform-mem0-mcp" rel="nofollow">Mem0 Dashboard</a>.
 </Info>

 ---
@@ -171,7 +171,7 @@ Agent: Updated your project status successfully.
 ## Quick Recovery

 - **"Connection refused"** → Check your internet connection and ensure the MCP client is correctly configured
- **"Invalid API key"** → Get a new key from <a href="https://app.mem0.ai/settings/api-keys" rel="nofollow">Mem0 Dashboard</a>
+- **"Invalid API key"** → Get a new key from <a href="https://app.mem0.ai/settings/api-keys?utm_source=oss&utm_medium=platform-mem0-mcp" rel="nofollow">Mem0 Dashboard</a>
 - **"npx command not found"** → Install Node.js from [nodejs.org](https://nodejs.org)

 ---
@@ -60,7 +60,7 @@ Mem0 is the memory engine that keeps conversations contextual so users never rep
  <Card title="Connect Integrations" icon="plug" href="/integrations">
    LangChain, CrewAI, Vercel AI SDK.
  </Card>
-  <Card title="Monitor in the Dashboard" icon="presentation" href="https://app.mem0.ai/login">
+  <Card title="Monitor in the Dashboard" icon="presentation" href="https://app.mem0.ai/login?utm_source=oss&utm_medium=platform-overview">
    Track activity and manage workspaces.
  </Card>
 </CardGroup>
@@ -150,7 +150,7 @@ Mem0 offers two powerful ways to add memory to your AI applications. Choose base
  <Card
    title="Try Platform Free"
    icon="rocket"
-    href="https://app.mem0.ai/login"
+    href="https://app.mem0.ai/login?utm_source=oss&utm_medium=platform-vs-oss"
  >
    Sign up and test the Platform with our free tier. No credit card required.
  </Card>
@@ -9,7 +9,7 @@ Get started with Mem0 Platform's hosted API in under 5 minutes. This guide shows

 ## Prerequisites

- Mem0 Platform account (<a href="https://app.mem0.ai" rel="nofollow">Sign up here</a>)
+- Mem0 Platform account (<a href="https://app.mem0.ai?utm_source=oss&utm_medium=platform-quickstart" rel="nofollow">Sign up here</a>)
 - API key (<a href="https://app.mem0.ai/dashboard/settings?tab=api-keys&subtab=configuration" rel="nofollow">Get one from dashboard</a>)
 - Python 3.10+, Node.js 14+, or cURL

@@ -12,7 +12,7 @@ We follow the llms.txt standard:
 - [llms.txt](https://docs.mem0.ai/llms.txt)

 <CardGroup cols={2}>
-  <Card title="Get an API Key" icon="key" href="https://app.mem0.ai/login">
+  <Card title="Get an API Key" icon="key" href="https://app.mem0.ai/login?utm_source=oss&utm_medium=vibecoding">
    Sign up for Mem0 Platform and start building
  </Card>
  <Card title="Quickstart" icon="rocket" href="/platform/quickstart">
@@ -34,7 +34,7 @@ Works with Claude Code, Cursor, Windsurf, and any assistant that supports skills

 Connect Claude, Claude Code, Cursor, Windsurf, VS Code, OpenCode, or any MCP-compatible client to Mem0.

-Get your API key from <a href="https://app.mem0.ai" rel="nofollow">app.mem0.ai</a>, then add Mem0 MCP with a single command:
+Get your API key from <a href="https://app.mem0.ai?utm_source=oss&utm_medium=vibecoding" rel="nofollow">app.mem0.ai</a>, then add Mem0 MCP with a single command:

 ```bash
 npx mcp-add \
@@ -91,7 +91,7 @@ export const Assistant = () => {
            </button>
            <GithubButton url="https://github.com/mem0ai/mem0/tree/main/examples" />

-            <Link href={"https://app.mem0.ai/"} target="_blank" className="py-1 ml-2 px-4 font-semibold dark:bg-zinc-100 dark:hover:bg-zinc-200 bg-zinc-800 text-white rounded-full hover:bg-zinc-900 dark:text-[#475569]">
+            <Link href={"https://app.mem0.ai/?utm_source=oss&utm_medium=example-mem0-demo"} target="_blank" className="py-1 ml-2 px-4 font-semibold dark:bg-zinc-100 dark:hover:bg-zinc-200 bg-zinc-800 text-white rounded-full hover:bg-zinc-900 dark:text-[#475569]">
              Playground
            </Link>
          </div>
@@ -174,7 +174,7 @@ export const Thread: FC<ThreadProps> = ({
                    <GithubButton url="https://github.com/mem0ai/mem0/tree/main/examples" className="w-full rounded-lg h-9 pl-2 text-sm font-semibold bg-zinc-800 dark:border-zinc-800 dark:text-white text-white hover:bg-zinc-900" text="View on Github" />

                    <Link
-                      href={"https://app.mem0.ai/"}
+                      href={"https://app.mem0.ai/?utm_source=oss&utm_medium=example-mem0-demo"}
                      target="_blank"
                      className="py-2 px-4 w-full rounded-lg h-9 pl-3 text-sm font-semibold dark:bg-zinc-800 dark:hover:bg-zinc-700 bg-zinc-800 text-white hover:bg-zinc-900 dark:text-white"
                    >
@@ -2,7 +2,7 @@

 Add persistent long-term memory to your [NemoClaw](https://docs.nvidia.com/nemoclaw/latest/get-started/quickstart.html) OpenClaw agent using the `@mem0/openclaw-mem0` plugin.

-> **Note:** This plugin requires **Mem0 Platform mode** (i.e., a Mem0 API key from [app.mem0.ai](https://app.mem0.ai)). Open-source mode is not supported in NemoClaw sandboxes because the sandbox proxy blocks `/v1/embeddings` requests required by the open-source backend. See [Known Limitations](#known-limitations) for details.
+> **Note:** This plugin requires **Mem0 Platform mode** (i.e., a Mem0 API key from [app.mem0.ai](https://app.mem0.ai?utm_source=oss&utm_medium=example-nemoclaw)). Open-source mode is not supported in NemoClaw sandboxes because the sandbox proxy blocks `/v1/embeddings` requests required by the open-source backend. See [Known Limitations](#known-limitations) for details.

 ## Prerequisites

@@ -15,7 +15,7 @@ Add persistent long-term memory to your [NemoClaw](https://docs.nvidia.com/nemoc
 **Accounts required:**

 - **NVIDIA** — sign up at [build.nvidia.com](https://build.nvidia.com), generate an API key at [build.nvidia.com/settings/api-keys](https://build.nvidia.com/settings/api-keys) (starts with `nvapi-`)
- **Mem0** — sign up at [app.mem0.ai](https://app.mem0.ai), generate an API key from the dashboard (starts with `m0-`)
+- **Mem0** — sign up at [app.mem0.ai](https://app.mem0.ai?utm_source=oss&utm_medium=example-nemoclaw), generate an API key from the dashboard (starts with `m0-`)

 **Supported platforms:** Ubuntu 22.04+, macOS (via Docker), Windows (WSL 2 + Docker)

@@ -269,4 +269,4 @@ Then re-run `nemoclaw onboard`.
 - [Mem0 Documentation](https://docs.mem0.ai)
 - [NemoClaw Documentation](https://docs.nvidia.com/nemoclaw/latest/get-started/quickstart.html)
 - [`@mem0/openclaw-mem0` on npm](https://www.npmjs.com/package/@mem0/openclaw-mem0)
- [Mem0 Dashboard](https://app.mem0.ai)
+- [Mem0 Dashboard](https://app.mem0.ai?utm_source=oss&utm_medium=example-nemoclaw)
@@ -4,7 +4,7 @@ import { zodResponsesFunction } from "openai/helpers/zod";
 import { z } from "zod";

 const mem0Config = {
-    apiKey: process.env.MEM0_API_KEY, // GET THIS API KEY FROM MEM0 (https://app.mem0.ai/dashboard/api-keys)
+    apiKey: process.env.MEM0_API_KEY, // GET THIS API KEY FROM MEM0 (https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=example-openai-inbuilt-tools)
    user_id: "sample-user",
 };

@@ -6,8 +6,8 @@ Add persistent memory to your AI workflows. Store, retrieve, and manage memories

 > **You must complete this step before installing the plugin.**

-1. Sign up at [app.mem0.ai](https://app.mem0.ai) if you haven't already
-2. Go to [app.mem0.ai/dashboard/api-keys](https://app.mem0.ai/dashboard/api-keys)
+1. Sign up at [app.mem0.ai](https://app.mem0.ai?utm_source=oss&utm_medium=mem0-plugin-readme) if you haven't already
+2. Go to [app.mem0.ai/dashboard/api-keys](https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=mem0-plugin-readme)
 3. Click **Create API Key** and copy the key (starts with `m0-`)
 4. Add it to your shell profile:

@@ -1,6 +1,6 @@
 # Mem0 Skill for Claude

-Add persistent memory to any AI application in minutes using [Mem0 Platform](https://app.mem0.ai).
+Add persistent memory to any AI application in minutes using [Mem0 Platform](https://app.mem0.ai?utm_source=oss&utm_medium=mem0-plugin-skill-readme).

 ## What This Skill Does

@@ -24,7 +24,7 @@ See the [plugin README](../../README.md) for full setup instructions.

 ### Prerequisites

- A Mem0 Platform API key ([Get one here](https://app.mem0.ai/dashboard/api-keys))
+- A Mem0 Platform API key ([Get one here](https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=mem0-plugin-skill-readme))
 - Python 3.10+ or Node.js 18+
 - Set the environment variable:

@@ -63,7 +63,7 @@ skills/mem0/

 ## Links

- [Mem0 Platform Dashboard](https://app.mem0.ai)
+- [Mem0 Platform Dashboard](https://app.mem0.ai?utm_source=oss&utm_medium=mem0-plugin-skill-readme)
 - [Mem0 Documentation](https://docs.mem0.ai)
 - [Mem0 GitHub](https://github.com/mem0ai/mem0)
 - [API Reference](https://docs.mem0.ai/api-reference)
@@ -35,7 +35,7 @@ npm install mem0ai
 export MEM0_API_KEY="m0-your-api-key"
 ```

-Get an API key at: https://app.mem0.ai/dashboard/api-keys
+Get an API key at: https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=mem0-plugin-skill

 ## Step 2: Initialize the client

@@ -5,7 +5,7 @@ Get running with Mem0 in 2 minutes. No infrastructure to deploy -- just an API k
 ## Prerequisites

 - Python 3.10+ or Node.js 18+
- A Mem0 Platform API key ([Get one here](https://app.mem0.ai/dashboard/api-keys))
+- A Mem0 Platform API key ([Get one here](https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=mem0-plugin-skill-quickstart))

 ## Python Setup

@@ -15,7 +15,7 @@ npm i mem0ai

 ## 2. API Key Setup

-For the cloud offering, sign in to [Mem0 Platform](https://app.mem0.ai/dashboard/api-keys) to obtain your API Key.
+For the cloud offering, sign in to [Mem0 Platform](https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=mem0-ts-readme) to obtain your API Key.

 ## 3. Client Features

@@ -29,7 +29,7 @@ openclaw --version
   openclaw plugins install @mem0/openclaw-mem0
   ```

-2. **Get your API key** from [app.mem0.ai](https://app.mem0.ai/dashboard/api-keys).
+2. **Get your API key** from [app.mem0.ai](https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=openclaw-readme).

 3. **Select the plugin as your memory backend in `openclaw.json`.** Either initialize via the CLI:

@@ -128,7 +128,7 @@ const memoryPlugin = definePluginEntry({
        "openclaw-mem0: API key not configured. Memory features are disabled.\n" +
          "  To set up, run:\n" +
          "  openclaw mem0 init\n" +
-          "  Get your key at: https://app.mem0.ai/dashboard/api-keys",
+          "  Get your key at: https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=openclaw-src",
      );

      // Register CLI even without API key — init command must be available
@@ -27,7 +27,7 @@
      "method": "api-key",
      "choiceId": "mem0-api-key",
      "choiceLabel": "Mem0 API key",
-      "choiceHint": "Required for platform mode. Get your key at https://app.mem0.ai/dashboard/api-keys",
+      "choiceHint": "Required for platform mode. Get your key at https://app.mem0.ai/dashboard/api-keys?utm_source=oss&utm_medium=openclaw-plugin",
      "groupId": "mem0",
      "groupLabel": "Mem0",
      "optionKey": "apiKey",
@@ -1,8 +1,8 @@
 OPENAI_API_KEY=
-NEO4J_URI=
-NEO4J_USERNAME=
-NEO4J_PASSWORD=

+# Optional: other bundled LLM/embedder providers (set the key for the one you want to use)
+# ANTHROPIC_API_KEY=
+# GOOGLE_API_KEY=

 POSTGRES_HOST=
 POSTGRES_PORT=
@@ -11,5 +11,23 @@ POSTGRES_USER=
 POSTGRES_PASSWORD=
 POSTGRES_COLLECTION_NAME=

-# Optional: set to enable API key authentication on all endpoints
 ADMIN_API_KEY=
+JWT_SECRET=
+# Local development only. Leave false in production.
+AUTH_DISABLED=false
+DASHBOARD_URL=http://localhost:3000
+APP_DB_NAME=mem0_app
+
+# Default LLM and embedder models. Provider must be in BUNDLED_*_PROVIDERS
+# (see server/main.py). Override to pin a specific model without editing code.
+MEM0_DEFAULT_LLM_MODEL=gpt-4.1-nano-2025-04-14
+MEM0_DEFAULT_EMBEDDER_MODEL=text-embedding-3-small
+
+# Anonymous telemetry. Sends a single onboarding event per install
+# (install UUID, email domain, server version, source). No PII.
+# Set to false to opt out.
+MEM0_TELEMETRY=true
+
+# Days of request_logs history to keep when `make prune-logs` runs.
+# Wire the prune command into cron/systemd in production.
+REQUEST_LOG_RETENTION_DAYS=30
@@ -1,7 +1,62 @@
+.PHONY: up down clean logs seed wait-api wait-dashboard bootstrap health build run_local reset-admin-password prune-logs
+
+OUTPUT ?= text
+API_URL ?= http://localhost:8888
+DASHBOARD_URL ?= http://localhost:3000
+
+up:
+	@for port in 3000 8888; do \
+		if lsof -iTCP:$$port -sTCP:LISTEN >/dev/null 2>&1; then \
+			echo "error: port $$port is already in use."; \
+			echo "find the owning process with: lsof -iTCP:$$port -sTCP:LISTEN"; \
+			exit 1; \
+		fi; \
+	done
+	docker compose up -d --build
+	@$(MAKE) --no-print-directory wait-api
+	@$(MAKE) --no-print-directory wait-dashboard
+	@echo ""
+	@echo "Stack is ready."
+	@echo "  Dashboard:  $(DASHBOARD_URL)  <- open this to run the setup wizard"
+	@echo "  API:        $(API_URL)"
+
+down:
+	docker compose down
+
+clean:
+	docker compose down -v
+
+logs:
+	docker compose logs -f
+
+seed:
+	@API_URL="$(API_URL)" DASHBOARD_URL="$(DASHBOARD_URL)" EMAIL="$(EMAIL)" PASSWORD="$(PASSWORD)" NAME="$(NAME)" OUTPUT="$(OUTPUT)" ./scripts/seed.sh
+
+wait-api:
+	@echo "Waiting for API..."
+	@until curl -fsS "$(API_URL)/auth/setup-status" >/dev/null 2>&1; do sleep 2; done
+
+wait-dashboard:
+	@echo "Waiting for dashboard..."
+	@until curl -fsS "$(DASHBOARD_URL)/api/health" >/dev/null 2>&1; do sleep 2; done
+
+bootstrap: up wait-api wait-dashboard seed
+
+health:
+	@echo "API:       $$(curl -s -o /dev/null -w '%{http_code}' "$(API_URL)/docs")"
+	@echo "Dashboard: $$(curl -s -o /dev/null -w '%{http_code}' "$(DASHBOARD_URL)/api/health")"
+	@echo "Postgres:  $$(docker compose exec -T postgres pg_isready -q && echo 'ok' || echo 'down')"
+
+reset-admin-password:
+	@test -n "$(EMAIL)" || (echo "usage: make reset-admin-password EMAIL=<email> PASSWORD=<password>" && exit 2)
+	@test -n "$(PASSWORD)" || (echo "usage: make reset-admin-password EMAIL=<email> PASSWORD=<password>" && exit 2)
+	@docker compose exec -T -e EMAIL="$(EMAIL)" -e PASSWORD="$(PASSWORD)" -e PYTHONPATH=/app mem0 python scripts/reset_admin_password.py
+
+prune-logs:
+	@docker compose exec -T -e REQUEST_LOG_RETENTION_DAYS="$(REQUEST_LOG_RETENTION_DAYS)" -e PYTHONPATH=/app mem0 python scripts/prune_request_logs.py
+
 build:
 	docker build -t mem0-api-server .

 run_local:
 	docker run -p 8000:8000 -v $(shell pwd):/app mem0-api-server --env-file .env
-
-.PHONY: build run_local
@@ -1,17 +1,126 @@
-# Mem0 REST API Server
+# Mem0 Self-Hosted Server

-Mem0 provides a REST API server (written using FastAPI). Users can perform all operations through REST endpoints. The API also includes OpenAPI documentation, accessible at `/docs` when the server is running.
+Mem0 ships a self-hosted FastAPI server plus a local dashboard. It is secure by default, supports dashboard login and API keys, and exposes OpenAPI docs at `/docs`.

-## Features
+## Quick Start

- **Create memories:** Create memories based on messages for a user, agent, or run.
- **Retrieve memories:** Get all memories for a given user, agent, or run.
- **Search memories:** Search stored memories based on a query.
- **Update memories:** Update an existing memory.
- **Delete memories:** Delete a specific memory or all memories for a user, agent, or run.
- **Reset memories:** Reset all memories for a user, agent, or run.
- **OpenAPI Documentation:** Accessible via `/docs` endpoint.
+### Agent-first

-## Running the server
+Run one command; the terminal prints the admin email, password, and first API key.

-Follow the instructions in the [docs](https://docs.mem0.ai/open-source/features/rest-api) to run the server.
+```bash
+cd server
+make bootstrap
+```
+
+This starts the stack, waits for the API and dashboard to be ready, creates the first admin, and generates the first API key.
+
+> The generated credentials print once in the `=== Ready ===` block. Save the password and API key before closing the terminal — the API key cannot be recovered afterwards.
+
+> `make bootstrap` skips the setup wizard, so the use-case → custom-instructions step doesn't run. To add custom instructions afterwards, `POST /configure` with `{"custom_instructions": "..."}`, or run the Browser-first flow on a fresh install.
+
+You can override the generated credentials:
+
+```bash
+cd server
+make bootstrap EMAIL=admin@company.com PASSWORD='strong-password' NAME='Admin'
+```
+
+For machine-readable output:
+
+```bash
+cd server
+OUTPUT=json make seed
+```
+
+Teardown:
+
+```bash
+# Stop the stack
+cd server && make down
+
+# Wipe all data (including the Postgres volume)
+cd server && make clean
+```
+
+### Browser-first
+
+Start the stack and finish setup by walking through the wizard in your browser.
+
+```bash
+cd server
+make up
+```
+
+Then open `http://localhost:3000` and complete the setup wizard.
+
+## Security Defaults
+
+- Dashboard login uses JWTs.
+- Programmatic access uses `X-API-Key`.
+- Auth is enabled by default.
+- `AUTH_DISABLED=true` exists for local development only and should not be used in production.
+
+## Forgotten password
+
+Reset an admin password from the host while the stack is running:
+
+```bash
+cd server
+make reset-admin-password EMAIL=admin@example.com PASSWORD='new-strong-password'
+```
+
+This is the supported recovery path. Anyone with shell access to the host already has full access to the database and secrets, so this command does not expand the attack surface.
+
+## Request log retention
+
+The `request_logs` table is append-only and grows with traffic (~864k rows/day at 10 req/s). Prune it periodically:
+
+```bash
+cd server
+make prune-logs                               # defaults to 30 days
+make prune-logs REQUEST_LOG_RETENTION_DAYS=7  # shorter window
+```
+
+Wire the command into cron or a systemd timer in production. The `created_at` column uses a BRIN index, so range deletes stay cheap even on large tables.
+
+## Local URLs
+
+- Dashboard: `http://localhost:3000`
+- API: `http://localhost:8888`
+- OpenAPI docs: `http://localhost:8888/docs`
+
+## Dashboard
+
+Once logged in, the dashboard exposes:
+
+- **Requests** — live audit log of API calls (method, path, status, latency).
+- **Memories** — browse memories, filter by user ID.
+- **Entities** — list every `user_id`, `agent_id`, and `run_id` that owns memories, with counts. Delete an entity to cascade-delete its memories.
+- **API Keys** — create, label, and revoke per-user keys.
+- **Configuration** — runtime LLM and embedder override. Changes persist to the app database and reapply on restart, layered over the values from your `.env`.
+- **Settings** — account profile and password.
+
+## Telemetry
+
+Enabled by default, matching the Mem0 OSS library. Sends at most two events per install to the same anonymous PostHog project the library uses:
+
+- `admin_registered` — fired when the first admin is created (wizard or direct API call). Properties: email domain, server version, install UUID.
+- `onboarding_completed` — fired when the setup wizard reaches its final success state. Carries the same properties plus the freeform `use_case` the operator entered. API-only bootstraps never emit this event.
+
+Set `MEM0_TELEMETRY=false` to opt out.
+
+## Security headers
+
+The dashboard sets the following response headers on every path (see `server/dashboard/next.config.mjs`):
+
+- `X-Frame-Options: DENY`
+- `Content-Security-Policy: frame-ancestors 'none'`
+- `X-Content-Type-Options: nosniff`
+- `Referrer-Policy: strict-origin-when-cross-origin`
+
+Together these prevent iframe embedding, sniffing of mislabelled MIME types, and cross-origin referrer leaks. Harden further behind your own reverse proxy if needed.
+
+## Reference
+
+Additional product and API documentation lives at [docs.mem0.ai](https://docs.mem0.ai/open-source/overview).
@@ -0,0 +1,37 @@
+[alembic]
+script_location = alembic
+prepend_sys_path = .
+sqlalchemy.url = postgresql+psycopg://postgres:postgres@postgres:5432/mem0_app
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARN
+handlers = console
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S
@@ -0,0 +1,44 @@
+from logging.config import fileConfig
+
+from alembic import context
+from sqlalchemy import engine_from_config, pool
+
+from db import Base, _build_database_url
+
+# Import models so Base.metadata picks up all tables
+import models  # noqa: F401
+
+config = context.config
+
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = Base.metadata
+
+# Override sqlalchemy.url from alembic.ini with the runtime database URL
+config.set_main_option("sqlalchemy.url", _build_database_url())
+
+
+def run_migrations_offline() -> None:
+    url = config.get_main_option("sqlalchemy.url")
+    context.configure(url=url, target_metadata=target_metadata, literal_binds=True)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def run_migrations_online() -> None:
+    connectable = engine_from_config(
+        config.get_section(config.config_ini_section, {}),
+        prefix="sqlalchemy.",
+        poolclass=pool.NullPool,
+    )
+    with connectable.connect() as connection:
+        context.configure(connection=connection, target_metadata=target_metadata)
+        with context.begin_transaction():
+            context.run_migrations()
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()
@@ -0,0 +1,26 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+# revision identifiers, used by Alembic.
+revision: str = ${repr(up_revision)}
+down_revision: Union[str, None] = ${repr(down_revision)}
+branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
+depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
+
+
+def upgrade() -> None:
+    ${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+    ${downgrades if downgrades else "pass"}
@@ -0,0 +1,49 @@
+"""Create users and api_keys tables
+
+Revision ID: 001
+Revises: None
+Create Date: 2026-04-10
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "001"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "users",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("name", sa.String(255), nullable=False),
+        sa.Column("email", sa.String(255), nullable=False),
+        sa.Column("password_hash", sa.Text(), nullable=False),
+        sa.Column("role", sa.String(20), nullable=False, server_default="admin"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("last_login_at", sa.DateTime(timezone=True), nullable=True),
+        sa.UniqueConstraint("email"),
+    )
+    op.create_index("ix_users_email", "users", ["email"])
+
+    op.create_table(
+        "api_keys",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("key_prefix", sa.String(12), nullable=False),
+        sa.Column("key_hash", sa.Text(), nullable=False),
+        sa.Column("label", sa.String(255), nullable=False),
+        sa.Column("created_by", sa.Uuid(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("api_keys")
+    op.drop_table("users")
@@ -0,0 +1,36 @@
+"""Create request_logs table
+
+Revision ID: 002
+Revises: 001
+Create Date: 2026-04-13
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "002"
+down_revision: Union[str, None] = "001"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "request_logs",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("method", sa.String(16), nullable=False),
+        sa.Column("path", sa.String(512), nullable=False),
+        sa.Column("status_code", sa.Integer(), nullable=False),
+        sa.Column("latency_ms", sa.Float(), nullable=False),
+        sa.Column("auth_type", sa.String(32), nullable=False, server_default="none"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+    )
+    op.create_index("ix_request_logs_created_at", "request_logs", ["created_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_request_logs_created_at", table_name="request_logs")
+    op.drop_table("request_logs")
@@ -0,0 +1,30 @@
+"""Create settings table
+
+Revision ID: 003
+Revises: 002
+Create Date: 2026-04-15
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "003"
+down_revision: Union[str, None] = "002"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "settings",
+        sa.Column("key", sa.String(255), primary_key=True),
+        sa.Column("value", sa.Text(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("settings")
@@ -0,0 +1,31 @@
+"""Enforce at-most-one admin via partial unique index
+
+Revision ID: 004
+Revises: 003
+Create Date: 2026-04-21
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "004"
+down_revision: Union[str, None] = "003"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_index(
+        "ix_users_only_one_admin",
+        "users",
+        ["role"],
+        unique=True,
+        postgresql_where=sa.text("role = 'admin'"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_users_only_one_admin", table_name="users")
@@ -0,0 +1,39 @@
+"""Create refresh_token_jtis table for single-use refresh tokens
+
+Revision ID: 005
+Revises: 004
+Create Date: 2026-04-21
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "005"
+down_revision: Union[str, None] = "004"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "refresh_token_jtis",
+        sa.Column("jti", sa.Uuid(), primary_key=True),
+        sa.Column(
+            "user_id",
+            sa.Uuid(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+    )
+    op.create_index("ix_refresh_token_jtis_expires_at", "refresh_token_jtis", ["expires_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_refresh_token_jtis_expires_at", table_name="refresh_token_jtis")
+    op.drop_table("refresh_token_jtis")
@@ -0,0 +1,26 @@
+"""Swap request_logs.created_at btree index for a BRIN index
+
+Revision ID: 006
+Revises: 005
+Create Date: 2026-04-21
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+revision: str = "006"
+down_revision: Union[str, None] = "005"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_index("ix_request_logs_created_at", table_name="request_logs")
+    op.execute("CREATE INDEX ix_request_logs_created_at ON request_logs USING BRIN (created_at)")
+
+
+def downgrade() -> None:
+    op.drop_index("ix_request_logs_created_at", table_name="request_logs")
+    op.create_index("ix_request_logs_created_at", "request_logs", ["created_at"])
@@ -0,0 +1,186 @@
+import os
+import secrets
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from fastapi import Depends, HTTPException, Request
+from fastapi.security import APIKeyHeader, HTTPAuthorizationCredentials, HTTPBearer
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from sqlalchemy import select, update
+from sqlalchemy.orm import Session
+
+from db import get_db
+from models import APIKey, RefreshTokenJti, User
+
+JWT_SECRET = os.environ.get("JWT_SECRET", "")
+JWT_ALGORITHM = "HS256"
+ACCESS_TOKEN_EXPIRE_MINUTES = 30
+REFRESH_TOKEN_EXPIRE_DAYS = 30
+ADMIN_API_KEY = os.environ.get("ADMIN_API_KEY", "")
+AUTH_DISABLED = os.environ.get("AUTH_DISABLED", "").lower() in {"1", "true", "yes", "on"}
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    return pwd_context.verify(plain, hashed)
+
+
+def dummy_verify_password() -> None:
+    """Burn the same bcrypt cycles as a real verify so login timing doesn't leak whether an email exists."""
+    pwd_context.dummy_verify()
+
+
+def generate_api_key() -> tuple[str, str, str]:
+    """Returns (full_key, prefix, hash)."""
+    raw = secrets.token_urlsafe(32)
+    full_key = f"m0sk_{raw}"
+    prefix = full_key[:12]
+    key_hash = pwd_context.hash(full_key)
+    return full_key, prefix, key_hash
+
+
+def verify_api_key_hash(plain_key: str, hashed: str) -> bool:
+    return pwd_context.verify(plain_key, hashed)
+
+
+def _get_secret() -> str:
+    if not JWT_SECRET:
+        raise HTTPException(status_code=500, detail="JWT_SECRET is not configured.")
+    return JWT_SECRET
+
+
+def create_access_token(user_id: str, role: str) -> str:
+    expire = datetime.now(timezone.utc) + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+    payload = {"sub": user_id, "role": role, "exp": expire, "type": "access"}
+    return jwt.encode(payload, _get_secret(), algorithm=JWT_ALGORITHM)
+
+
+def create_refresh_token(user_id: str, db: Session) -> str:
+    expire = datetime.now(timezone.utc) + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
+    jti = uuid.uuid4()
+    db.add(RefreshTokenJti(jti=jti, user_id=uuid.UUID(user_id), expires_at=expire))
+    db.commit()
+    payload = {"sub": user_id, "exp": expire, "jti": str(jti), "type": "refresh"}
+    return jwt.encode(payload, _get_secret(), algorithm=JWT_ALGORITHM)
+
+
+def consume_refresh_jti(jti: str, db: Session) -> None:
+    """Atomically mark a refresh token's jti as used. Raises 401 if missing, already used, or expired.
+
+    The conditional UPDATE closes the read-check-write race: concurrent replays of the same
+    token race on a single row, so at most one update affects a row and the rest see rowcount 0.
+    """
+    try:
+        jti_uuid = uuid.UUID(jti)
+    except (TypeError, ValueError):
+        raise HTTPException(status_code=401, detail="Refresh token is no longer valid.")
+    now = datetime.now(timezone.utc)
+    result = db.execute(
+        update(RefreshTokenJti)
+        .where(
+            RefreshTokenJti.jti == jti_uuid,
+            RefreshTokenJti.used_at.is_(None),
+            RefreshTokenJti.expires_at > now,
+        )
+        .values(used_at=now)
+    )
+    if result.rowcount == 0:
+        raise HTTPException(status_code=401, detail="Refresh token is no longer valid.")
+    db.commit()
+
+
+def decode_token(token: str) -> dict:
+    try:
+        return jwt.decode(token, _get_secret(), algorithms=[JWT_ALGORITHM])
+    except JWTError:
+        raise HTTPException(status_code=401, detail="Invalid or expired token.")
+
+
+bearer_scheme = HTTPBearer(auto_error=False)
+api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
+
+
+def _mark_auth_type(request: Request, auth_type: str) -> None:
+    request.state.auth_type = auth_type
+
+
+def _get_default_user(db: Session) -> User | None:
+    return db.scalar(select(User).order_by(User.created_at.asc()))
+
+
+def _resolve_user_from_jwt(token: str, db: Session) -> User:
+    payload = decode_token(token)
+    if payload.get("type") != "access":
+        raise HTTPException(status_code=401, detail="Invalid token type.")
+    user = db.get(User, payload.get("sub"))
+    if user is None:
+        raise HTTPException(status_code=401, detail="User not found.")
+    return user
+
+
+def _resolve_user_from_api_key(key: str, db: Session) -> User:
+    prefix = key[:12] if len(key) >= 12 else key
+    candidates = (
+        db.execute(select(APIKey).where(APIKey.key_prefix == prefix, APIKey.revoked_at.is_(None))).scalars().all()
+    )
+
+    for candidate in candidates:
+        if verify_api_key_hash(key, candidate.key_hash):
+            candidate.last_used_at = datetime.now(timezone.utc)
+            db.commit()
+            user = db.get(User, candidate.created_by)
+            if user is None:
+                raise HTTPException(status_code=401, detail="API key owner not found.")
+            return user
+
+    raise HTTPException(status_code=401, detail="Invalid API key.")
+
+
+async def verify_auth(
+    request: Request,
+    credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
+    x_api_key: str | None = Depends(api_key_header),
+    db: Session = Depends(get_db),
+) -> User | None:
+    """Authenticate via JWT, X-API-Key, or legacy ADMIN_API_KEY. Returns User or None."""
+    if credentials is not None:
+        _mark_auth_type(request, "bearer")
+        return _resolve_user_from_jwt(credentials.credentials, db)
+
+    if x_api_key is not None:
+        if ADMIN_API_KEY and secrets.compare_digest(x_api_key, ADMIN_API_KEY):
+            _mark_auth_type(request, "admin_api_key")
+            return None
+        _mark_auth_type(request, "api_key")
+        return _resolve_user_from_api_key(x_api_key, db)
+
+    if AUTH_DISABLED:
+        _mark_auth_type(request, "disabled")
+        return None
+
+    raise HTTPException(
+        status_code=401,
+        detail="Authentication required. Provide a Bearer token or X-API-Key header.",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+
+async def require_auth(
+    request: Request,
+    user: User | None = Depends(verify_auth),
+    db: Session = Depends(get_db),
+) -> User:
+    """Like verify_auth but guarantees a non-None User. Use for endpoints that require auth."""
+    if user is None:
+        if getattr(request.state, "auth_type", "none") in {"admin_api_key", "disabled"}:
+            default_user = _get_default_user(db)
+            if default_user is not None:
+                return default_user
+        raise HTTPException(status_code=401, detail="Authentication required.")
+    return user
@@ -0,0 +1,6 @@
+node_modules
+.next
+.env.local
+.env.example
+.env
+.storybook
@@ -0,0 +1,3 @@
+NEXT_PUBLIC_API_URL=http://localhost:8888
+API_INTERNAL_URL=http://localhost:8888
+NEXT_PUBLIC_INSTANCE_NAME=Mem0
@@ -0,0 +1,3 @@
+{
+  "extends": ["next/core-web-vitals"]
+}
@@ -0,0 +1,39 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+.yarn/install-state.gz
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env*.local
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+
+*storybook.log
+storybook-static
@@ -0,0 +1,51 @@
+FROM node:20-alpine AS base
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+# Dependencies
+FROM base AS deps
+COPY package.json yarn.lock* package-lock.json* pnpm-lock.yaml* ./
+RUN \
+  if [ -f yarn.lock ]; then yarn --frozen-lockfile --network-timeout 600000; \
+  elif [ -f package-lock.json ]; then npm ci; \
+  elif [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm i; \
+  else npm install; \
+  fi
+
+# Build
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+ENV NEXT_TELEMETRY_DISABLED=1
+# Placeholder values replaced at runtime by entrypoint.sh
+ENV NEXT_PUBLIC_API_URL=NEXT_PUBLIC_API_URL
+ENV NEXT_PUBLIC_INSTANCE_NAME=NEXT_PUBLIC_INSTANCE_NAME
+
+RUN npm run build
+
+# Production
+FROM base AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --chown=nextjs:nodejs entrypoint.sh /home/nextjs/entrypoint.sh
+RUN chmod +x /home/nextjs/entrypoint.sh
+
+USER nextjs
+
+EXPOSE 3000
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+ENTRYPOINT ["/home/nextjs/entrypoint.sh"]
+CMD ["node", "server.js"]
@@ -0,0 +1,17 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "new-york",
+  "rsc": true,
+  "tsx": true,
+  "tailwind": {
+    "config": "tailwind.config.ts",
+    "css": "src/styles/globals.css",
+    "baseColor": "zinc",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils"
+  }
+}
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+cd /app
+
+# Swap NEXT_PUBLIC_* placeholders baked into .next/ at build time with the
+# container's real env values. Each placeholder must be declared in the
+# Dockerfile as `ENV NAME=NAME` so Next.js inlines the literal name. Currently:
+#   NEXT_PUBLIC_API_URL, NEXT_PUBLIC_INSTANCE_NAME
+# New NEXT_PUBLIC_* vars must be added to the Dockerfile or this loop won't substitute them.
+printenv | grep '^NEXT_PUBLIC_' | while IFS='=' read -r key value; do
+  escaped=$(printf '%s' "$value" | sed -e 's/[\\&|]/\\&/g')
+  find .next/ -type f -exec sed -i "s|$key|$escaped|g" {} \;
+done
+echo "Done replacing env variables NEXT_PUBLIC_ with real values"
+
+exec "$@"
@@ -0,0 +1,41 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  output: "standalone",
+  eslint: {
+    ignoreDuringBuilds: false,
+  },
+  typescript: {
+    ignoreBuildErrors: false,
+  },
+  experimental: {
+    optimizePackageImports: ["@/components", "@/lib", "@/utils"],
+  },
+  compress: true,
+  images: {
+    formats: ["image/webp", "image/avif"],
+  },
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: [
+          { key: "X-Frame-Options", value: "DENY" },
+          { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+        ],
+      },
+    ];
+  },
+  redirects: async () => {
+    return [
+      {
+        source: "/settings",
+        destination: "/dashboard/settings",
+        permanent: false,
+      },
+    ];
+  },
+};
+
+export default nextConfig;
@@ -0,0 +1,83 @@
+{
+  "name": "mem0-dashboard",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "prettier --check .",
+    "format": "prettier --write .",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@hookform/resolvers": "^3.6.0",
+    "@radix-ui/react-accordion": "^1.2.0",
+    "@radix-ui/react-alert-dialog": "^1.1.4",
+    "@radix-ui/react-avatar": "^1.0.4",
+    "@radix-ui/react-checkbox": "^1.0.4",
+    "@radix-ui/react-collapsible": "^1.1.3",
+    "@radix-ui/react-dialog": "^1.1.1",
+    "@radix-ui/react-dropdown-menu": "^2.0.6",
+    "@radix-ui/react-hover-card": "^1.1.1",
+    "@radix-ui/react-icons": "^1.3.0",
+    "@radix-ui/react-label": "^2.1.0",
+    "@radix-ui/react-popover": "^1.0.7",
+    "@radix-ui/react-progress": "^1.1.0",
+    "@radix-ui/react-radio-group": "^1.2.0",
+    "@radix-ui/react-scroll-area": "^1.0.5",
+    "@radix-ui/react-select": "^2.1.1",
+    "@radix-ui/react-separator": "^1.1.0",
+    "@radix-ui/react-slider": "^1.2.2",
+    "@radix-ui/react-slot": "^1.2.3",
+    "@radix-ui/react-switch": "^1.1.2",
+    "@radix-ui/react-tabs": "^1.1.0",
+    "@radix-ui/react-toast": "^1.2.1",
+    "@radix-ui/react-tooltip": "^1.0.7",
+    "@reduxjs/toolkit": "^2.3.0",
+    "@tanstack/react-table": "^8.17.3",
+    "axios": "^1.6.8",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.0",
+    "cmdk": "^1.0.0",
+    "date-fns": "^4.1.0",
+    "framer-motion": "^12.23.12",
+    "lodash": "^4.17.21",
+    "lucide-react": "^0.542.0",
+    "next": "15.2.6",
+    "next-themes": "^0.4.4",
+    "react": "^19.0.0",
+    "react-copy-to-clipboard": "^5.1.0",
+    "react-day-picker": "8.10.1",
+    "react-dom": "^19.0.0",
+    "react-hook-form": "^7.52.0",
+    "react-redux": "^9.1.2",
+    "react-syntax-highlighter": "^15.5.0",
+    "recharts": "^2.15.0",
+    "redux": "^5.0.1",
+    "sonner": "^1.4.41",
+    "tailwind-merge": "^2.2.0",
+    "tailwindcss-animate": "^1.0.7",
+    "use-debounce": "^10.0.4",
+    "uuid": "^9.0.1",
+    "vaul": "^0.9.1",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@tailwindcss/typography": "^0.5.13",
+    "@types/lodash": "^4.17.7",
+    "@types/node": "22.5.4",
+    "@types/react": "^19.0.0",
+    "@types/react-copy-to-clipboard": "^5.0.7",
+    "@types/react-dom": "^19.0.0",
+    "@types/react-syntax-highlighter": "^15.5.13",
+    "@types/uuid": "^9.0.8",
+    "autoprefixer": "^10.0.1",
+    "eslint": "^8",
+    "eslint-config-next": "15.2.6",
+    "postcss": "^8",
+    "prettier": "^3.5.2",
+    "tailwindcss": "^3.3.0",
+    "typescript": "^5.6.3"
+  }
+}
@@ -0,0 +1,6 @@
+module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
--- a/Show More
+++ b/Show More