mem0ai/mem0 · error · NotFoundError

Resource not found: ${path}

Error message

Resource not found: ${path}

What it means

verify_auth raises this 401 when the request carries neither a Bearer Authorization header nor an X-API-Key header, and AUTH_DISABLED is not enabled. It is the server's baseline authentication gate: some credential must be presented on every protected endpoint unless auth was explicitly disabled for local development.

Source

Thrown at cli/node/src/backend/platform.ts:71

			"X-Mem0-Caller-Type": isAgentMode() ? "agent" : "user",
		};

		const fetchOpts: RequestInit = {
			method,
			headers,
			signal: AbortSignal.timeout(30_000),
		};
		if (opts?.json) {
			fetchOpts.body = JSON.stringify(opts.json);
		}

		const resp = await fetch(url, fetchOpts);

		if (resp.status === 401) {
			throw new AuthError();
		}
		if (resp.status === 404) {
			throw new NotFoundError(path);
		}
		if (resp.status === 400) {
			let detail: string;
			try {
				const body = (await resp.json()) as Record<string, unknown>;
				detail =
					((body.detail ?? body.message ?? JSON.stringify(body)) as string) ??
					resp.statusText;
			} catch {
				detail = resp.statusText;
			}
			throw new APIError(path, detail);
		}
		if (!resp.ok) {
			let detail: string = resp.statusText;
			try {
				const body = (await resp.json()) as Record<string, unknown>;
				detail = (body.detail ?? body.message ?? resp.statusText) as string;

View on GitHub (pinned to 001c235229)

Solutions

1. Send Authorization: Bearer <access_token> obtained from POST /auth/login, or an X-API-Key: <key> header on every request.
2. For a fast no-client-change setup, set ADMIN_API_KEY=<long-random-value> in the server .env and send it as X-API-Key.
3. Register the first admin at http://<host>:3000/setup to get JWT credentials.
4. For local development only, set AUTH_DISABLED=true (never in production).
5. If behind a reverse proxy, verify it forwards the Authorization and X-API-Key headers.

Example fix

# before
resp = requests.get(f"{BASE}/memories")

# after
resp = requests.get(f"{BASE}/memories", headers={"Authorization": f"Bearer {access_token}"})

def auth_headers(token: str | None, api_key: str | None) -> dict:
    if token:
        return {"Authorization": f"Bearer {token}"}
    if api_key:
        return {"X-API-Key": api_key}
    raise ValueError("No credential available: log in first or configure an API key")

if resp.status_code == 401 and "Authentication required" in resp.text:
    token = refresh_or_login()  # obtain credentials, then retry once
    resp = session.request(method, url, headers=auth_headers(token, None), ...)

When it happens

Trigger: Calling any protected endpoint (e.g. POST /memories, GET /memories) with curl and no headers; a client that puts the token in a custom header instead of Authorization: Bearer <jwt>; a frontend that only sets the API key on some requests; sending Authorization: Bearer with an empty token string.

Common situations: Fresh self-hosted deployment where the developer has not yet registered an admin at /setup or set ADMIN_API_KEY; a proxy (nginx) stripping the Authorization header; a browser fetch that drops credentials because the client is cross-origin without Access-Control-Allow-Credentials; a script written before auth was added to the server.

Related errors

• Authentication failed. Your API key may be invalid or expire
• Bad request to ${path}: ${detail}
• Either memoryId or --all is required
• At least one message is required
• Resource not found: ${path}

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/52116ec048cf8de2. Report an issue: GitHub.