Start

Keys and projects. Everything here runs once, before any data moves.

• Keys

  Three credentials reach this API. An account key (`rlka_`) authenticates you and names its target project per request, so it can never reach past what you can reach and loses a project the moment your access does. A project key (`rlk_`) is bound to one project at a fixed tier — what you hand a service that should reach that project and nothing else. A site key belongs to a published site's page code and authenticates the site, never a person. The first two are bearer tokens on any client, from any origin — a key does not care whether the caller was built with Runlog.

• Projects

  A project is the memory boundary. Every file you ingest, every cell the pipeline derives, and every retrieval you run is scoped to one project id, which rides on the `X-Project-Id` header of every request. Projects are non-enumerable: a project you cannot reach answers 404, never 403.