Guides

Multi-tenant Applications

Keep workloads and represented users separated by combining organization access, project scope, and a stable opaque end-user identifier on every server-side memory request.

Use each scope for one job

Scope	Use it for
Organization	Team ownership, membership, and account-level administration.
Project	An application, customer boundary, or workload with its own credentials.
End user	The person whose memory your service request represents.

Recommended request pattern

import os
from memorysync import MemorySyncClient

client = MemorySyncClient(
    api_key=os.environ["MEMORYSYNC_API_KEY"],
    base_url="https://api.memorysync.io",
    project_id=os.environ["MEMORYSYNC_PROJECT_ID"],
    end_user_id="user-123",
)

result = client.query("How should I format the answer?", k=5)
for memory in result.memories:
    print(memory.text)

Derive the project and end-user values from authenticated application context. Do not accept arbitrary scope headers from an untrusted client and forward them unchanged.

Identifier guidelines

Use stable opaque values generated by your system.
Keep the mapping from your customer identity to the external identifier in your application.
Use separate projects or credentials when workloads have different access boundaries.
Never use a shared end-user identifier for unrelated people.

Authorize before retrieval

1Authenticate the person or service calling your application.
2Resolve the project and end-user identifier from trusted server-side data.
3Call MemorySync from the server with that scope.
4Filter the response again according to your product authorization rules before returning data.

Isolation tests to run

User A cannot retrieve User B’s memory.
A credential for one project cannot access another project through your application.
Missing or malformed scope fails safely.
Exports and deletion operations target only the intended scope.

Was this page helpful?

← Previous

Personalization

Cost Optimization