Supermemory v0.0.8 |Cannot load documents and stats that's NOT from localhost

[gwashark]

When you load up the dash, and switch to the memory tab, it says 401 unauthorized.

I am hosting this on a linux device that I can access through it's IP address on the network.

Right now I am using a modifier to add the api key to the auth to view it but if there would be an option for it that would be nice.

[linear-code]

ENG-1197

[Souravrajvi0]

Hi @Dhravya , I reproduced this on supermemory-server v0.0.8 (linux-x64) by opening the local dash via a LAN IP instead of localhost.

what i understood from this

• GET / still loads over http://<machine-ip>:6767 (overview is fine).
• Switching to the Memory tab loads /local-console.js, which then calls:
  • POST /v3/documents/documents
  • GET /v3/container-tags/list
• Those fetches send no Authorization header. They rely on the boot-banner behavior: “the api key above is auto-applied for unauthenticated localhost requests.”
• That auto-auth is a Host check (localhost / 127.0.0.1 / ::1), not “are you on the same machine.” A LAN hostname like 192.168.x.x does not qualify, so those routes return {"error":"Unauthorized"} with 401.
• Adding Authorization: Bearer <banner key> on the same LAN URL returns 200. That matches using a request modifier to inject the API key.

Direct vs LAN (no auth):

Request	Result
POST /v3/documents/documents → 127.0.0.1:6767	200
Same path → LAN IP :6767	401
LAN IP + Authorization: Bearer sm_…	200

SDK/curl clients that already send the key are unaffected; this is a dashboard-only gap.

The direction I thought of

A durable fix belongs in the self-hosted binary:

1. Have /local-console.js send the printed API key (same as the overview copy snippets), or
2. An explicit allowlist for extra Hosts (something like SUPERMEMORY_TRUSTED_HOSTS) so LAN access is opt-in rather than treating every non-loopback Host as anonymous.

Until a server-v* release includes that, practical workarounds:

• SSH tunnel and browse http://localhost:6767 (ssh -L 6767:127.0.0.1:6767 user@box), or
• Inject the banner key (request modifier), or
• The small proxy in fix(self-host): Memory tab 401 when opening the dash via LAN IP #1637 which forwards to :6767 and adds Authorization when the Memory tab omits it (http://<lan-ip>:6768). Anyone who can reach that proxy has owner-level API access, so it should stay on a trusted network only.

Happy to adjust the PR if you’d rather land the Host allowlist / dash header in the binary first.