Authentication
Permissions
What each credential, plan and organization role can do
Access in HyperMemory is decided by three things: which graph a credential reaches, your role on that graph, and your plan.
Credentials
| Credential | Reaches | Can |
|---|---|---|
OAuth sign-in (MCP clients, plugins, CLI hm login) | Your default graph, plus read access to your organizations’ graphs | Read and write your graph |
| API key | The one graph it’s bound to | Read and write that graph |
| Dashboard session | Everything in your account | Everything, including billing and account settings |
Some actions are only possible from a signed-in dashboard session — never with an API key or OAuth token: managing billing, deleting your account, managing organization members and turning on organization write mode.
Organization roles
| Role | Organization graph | Administration |
|---|---|---|
| Owner | Read; write through organization write mode | Everything, including choosing the organization’s graph. Can’t leave or be removed. |
| Org admin | Read; write through organization write mode | Invite and remove members, buy seats, manage organization skills, provider connections and settings. |
| Org user | Read only | None. |
Every member’s recall searches the organization’s memory alongside their own. Members never write to it. See Members & roles.
Plan features
| Feature | Plans |
|---|---|
| All tools, plugins, CLI, REST, file upload | All plans |
| Token usage dashboard | Basic and above |
| Custom agent skills | Pro and above |
| Organizations | Business and Enterprise |
| More than one memory graph | Pro (4), Business (20), Enterprise (unlimited) |
See Plans.
Public graph read API
Each graph has an API access switch on the dashboard’s graph list, off by default. Turning it on lets an API key bound to that graph read it in bulk through the public graph API (GET /api/graphs/{graph_id}/public/v2, paged, up to 200 items per page). It doesn’t affect MCP or the memory REST API.
OAuth scopes
OAuth clients may request memory:read, memory:write or memory:admin. These are advertised for compatibility and don’t currently restrict what a signed-in client can do.