API and CLI authentication

Accessing resources via the Memfault API or the Memfault CLI requires authentication. Several mechanisms are available, each with subtle differences in scope and limitations.

note

The recommended authentication mechanism for automation scripts is the organization auth token.

Organization auth token

Requests authenticated with an organization auth token can only access the resources of their respective organization. Organization admins can create and delete organization auth tokens.

Organization auth tokens have the same access level as project managers, and that access level applies to every project in the organization.

API

curl -H "Authorization: Bearer $ORGANIZATION_AUTH_TOKEN" https://api.memfault.com/api/v0/organizations/<ORG_SLUG>/projects

CLI

memfault --org-token "$ORGANIZATION_AUTH_TOKEN" ...

User API key

Requests authenticated with a user API key can access the resources of every organization the user belongs to, except when SSO is required. User API keys are not suitable for automation, because they stop working when the user is removed from the organization.

Users can create and cycle their user API key under Project Settings → User API Key. The key appears under a project, but it is not tied to a specific project.

API

curl -u "$USER_EMAIL:$USER_API_KEY" https://api.memfault.com/api/v0/organizations

CLI

memfault --email "$USER_EMAIL" --password "$USER_API_KEY" ...

note

A user can authenticate with their account password instead of a user API key, but doing so is not recommended.

Project key

Requests authenticated with a project key (sometimes also called a "project API key") have limited access to a single project. Project keys are intended for devices that send data to Memfault, and, unlike the other mechanisms listed here, they are not considered secrets. They are also useful during initial development for uploading coredumps from a developer's machine.

A project key is generated automatically when a project is created. Organization admins and project managers can generate and cycle the project key via the project key API endpoint. Every project member can see the project's project key.

API

curl --header "Memfault-Project-Key: $YOUR_PROJECT_KEY" ...

CLI

memfault --project-key "$YOUR_PROJECT_KEY" ...