API Access

Every Memos feature is available over the API. To call it programmatically, create a personal access token and send it as a Bearer credential.

Create a personal access token

Create and revoke tokens from your user settings in the app. Tokens use the memos_pat_ prefix, and the plain token value is shown only once at creation — store it somewhere safe.

New tokens default to no expiration; you can choose an expiration when creating one. The settings page shows whether each token has ever been used, its last-used time, and its expiration status. Use a separate token for each application so you can revoke one integration without disrupting another.

Tokens are scoped to your user: API calls made with a token can do what your user can do.

Call the API

Pass the token in the Authorization header:

curl -H "Authorization: Bearer memos_pat_..." \
  https://memos.example.com/api/v1/memos

For browser-based integrations, bearer-token requests may be sent cross-origin. Cookie authentication remains same-origin; do not build third-party API clients around a user's browser session cookie.

Where to go next

• API Reference — every service and method, REST and gRPC
• Webhooks — push events instead of polling
• MCP Server — connect AI assistants using the same tokens
• Security — the full token security model