Workspace Isolation

A workspace is the isolated memory store tied to one API key. Every memory you store, every relationship the discovery pipeline creates, and every search result you retrieve exists within that workspace and is invisible to any other. One API key corresponds to one workspace. There is no cross-workspace query.

This isolation model is enforced at the query layer: every database operation filters by workspace_id. A search that does not include your workspace_id returns no results — not an error, not leaked data from another workspace, nothing.

The One Key, One Workspace Rule

When you generate an API key at app.neuroloom.dev/settings/api-keys, Neuroloom creates a workspace and binds the key to it. The key authenticates your requests and scopes them to that workspace simultaneously.

There is no separate workspace provisioning step. Generate a key, and the workspace exists.

# All requests with this key read from and write to workspace_id: ws_abc123
export NEUROLOOM_API_KEY="nl_live_abc..."

curl -X POST https://api.neuroloom.dev/api/v1/memories/search \
  -H "Authorization: Token $MEMORIES_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "database migration strategy"}'

The workspace_id is resolved server-side from the API key when you omit it from the request body — this is the recommended approach. You can also pass it explicitly in request bodies if needed (for example, to target a different workspace than the key's default).

Finding Your Workspace ID

Your workspace_id appears in the dashboard at app.neuroloom.dev/settings/workspace. It also appears in every API response that returns a memory or relationship record — look for the workspace_id field.

{
  "memory_id": "mem_abc123",
  "workspace_id": "ws_abc123",
  "title": "Database migration strategy",
  ...
}

If you need the workspace ID programmatically, call the workspace info endpoint:

curl https://api.neuroloom.dev/api/v1/workspace \
  -H "Authorization: Token $MEMORIES_API_TOKEN"

Response:

{
  "workspace_id": "ws_abc123",
  "name": "My Project",
  "created_at": "2026-01-15T10:00:00Z",
  "memory_count": 142,
  "plan": "pro"
}

Isolation Guarantees

Every query in Neuroloom includes a workspace_id filter. This covers:

• Memory storage and retrieval
• Semantic search (the pgvector similarity query)
• Relationship creation and graph traversal
• PageRank scoring and community detection
• Session management

Multi-Workspace Patterns

Most developers use one workspace per project. Generate one API key, store that key in the project's environment, and all memory operations for that project land in one place.

If you need multiple isolated memory stores, generate multiple API keys. Each key gets its own workspace. Common patterns:

Per-project isolation: One API key per repository or project. A monorepo might use a single workspace; a microservices setup might use one per service if the teams are independent.

# .env in project-a
NEUROLOOM_API_KEY="nl_live_project_a_..."

# .env in project-b
NEUROLOOM_API_KEY="nl_live_project_b_..."

Per-environment isolation: Separate workspaces for development, staging, and production memory stores. Development sessions do not pollute the production memory store.

NEUROLOOM_API_KEY_DEV="nl_live_dev_..."
NEUROLOOM_API_KEY_PROD="nl_live_prod_..."

Per-agent-type isolation: If you run multiple agent types (coding agent, documentation agent, review agent), separate workspaces let each agent build a focused memory store without cross-contamination.

Workspace Limits by Plan

Memory counts and retention periods appear in the dashboard. When a workspace approaches its memory limit, Neuroloom surfaces the lowest-importance memories as pruning candidates. See Memory Lifecycle for details on importance scoring and pruning.

Rotating API Keys

Rotating a key does not change the workspace. The new key binds to the same workspace as the old one. All memories, relationships, and scores are preserved.

Rotate a key from app.neuroloom.dev/settings/api-keys. After rotation, update the key in any environment or tool that uses it — the old key is immediately invalidated.

Related Pages

• Quickstart — authenticate and store your first memory
• Memories API Reference — full endpoint reference including workspace-scoped operations