{"record":{"id":"52116ec048cf8de2","repo":"mem0ai/mem0","slug":"resource-not-found-path","errorCode":null,"errorMessage":"Resource not found: ${path}","messagePattern":"Resource not found: (.+?)","errorType":"http","errorClass":"NotFoundError","httpStatus":404,"severity":"error","filePath":"cli/node/src/backend/platform.ts","lineNumber":71,"sourceCode":"\t\t\t\"X-Mem0-Caller-Type\": isAgentMode() ? \"agent\" : \"user\",\n\t\t};\n\n\t\tconst fetchOpts: RequestInit = {\n\t\t\tmethod,\n\t\t\theaders,\n\t\t\tsignal: AbortSignal.timeout(30_000),\n\t\t};\n\t\tif (opts?.json) {\n\t\t\tfetchOpts.body = JSON.stringify(opts.json);\n\t\t}\n\n\t\tconst resp = await fetch(url, fetchOpts);\n\n\t\tif (resp.status === 401) {\n\t\t\tthrow new AuthError();\n\t\t}\n\t\tif (resp.status === 404) {\n\t\t\tthrow new NotFoundError(path);\n\t\t}\n\t\tif (resp.status === 400) {\n\t\t\tlet detail: string;\n\t\t\ttry {\n\t\t\t\tconst body = (await resp.json()) as Record<string, unknown>;\n\t\t\t\tdetail =\n\t\t\t\t\t((body.detail ?? body.message ?? JSON.stringify(body)) as string) ??\n\t\t\t\t\tresp.statusText;\n\t\t\t} catch {\n\t\t\t\tdetail = resp.statusText;\n\t\t\t}\n\t\t\tthrow new APIError(path, detail);\n\t\t}\n\t\tif (!resp.ok) {\n\t\t\tlet detail: string = resp.statusText;\n\t\t\ttry {\n\t\t\t\tconst body = (await resp.json()) as Record<string, unknown>;\n\t\t\t\tdetail = (body.detail ?? body.message ?? resp.statusText) as string;","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/cli/node/src/backend/platform.ts#L53-L89","documentation":"verify_auth raises this 401 when the request carries neither a Bearer Authorization header nor an X-API-Key header, and AUTH_DISABLED is not enabled. It is the server's baseline authentication gate: some credential must be presented on every protected endpoint unless auth was explicitly disabled for local development.","triggerScenarios":"Calling any protected endpoint (e.g. POST /memories, GET /memories) with curl and no headers; a client that puts the token in a custom header instead of Authorization: Bearer <jwt>; a frontend that only sets the API key on some requests; sending Authorization: Bearer with an empty token string.","commonSituations":"Fresh self-hosted deployment where the developer has not yet registered an admin at /setup or set ADMIN_API_KEY; a proxy (nginx) stripping the Authorization header; a browser fetch that drops credentials because the client is cross-origin without Access-Control-Allow-Credentials; a script written before auth was added to the server.","solutions":["Send Authorization: Bearer <access_token> obtained from POST /auth/login, or an X-API-Key: <key> header on every request.","For a fast no-client-change setup, set ADMIN_API_KEY=<long-random-value> in the server .env and send it as X-API-Key.","Register the first admin at http://<host>:3000/setup to get JWT credentials.","For local development only, set AUTH_DISABLED=true (never in production).","If behind a reverse proxy, verify it forwards the Authorization and X-API-Key headers."],"exampleFix":"# before\nresp = requests.get(f\"{BASE}/memories\")\n\n# after\nresp = requests.get(f\"{BASE}/memories\", headers={\"Authorization\": f\"Bearer {access_token}\"})","handlingStrategy":"validation","validationCode":"def auth_headers(token: str | None, api_key: str | None) -> dict:\n    if token:\n        return {\"Authorization\": f\"Bearer {token}\"}\n    if api_key:\n        return {\"X-API-Key\": api_key}\n    raise ValueError(\"No credential available: log in first or configure an API key\")","typeGuard":null,"tryCatchPattern":"if resp.status_code == 401 and \"Authentication required\" in resp.text:\n    token = refresh_or_login()  # obtain credentials, then retry once\n    resp = session.request(method, url, headers=auth_headers(token, None), ...)","preventionTips":["Wrap the API client so every request automatically attaches credentials.","Centralize login/refresh in one place instead of per-call headers.","Smoke-test deployments with an authenticated ping before real traffic."],"tags":["auth","http-401","rest-server","configuration"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}