Open Memory

Open Memory is a memory layer for AI products with a public marketing site and a usable SaaS workspace demo. The default deployment target is Next.js/Vercel; the original Sites/Vinext target remains available through the sites:* scripts.

Prerequisites

• Node.js >=22.13.0

Quick Start

npm install
npm run dev
npm run build

This starter does not use wrangler.jsonc.

Product surfaces

• Public marketing pages under app/
• Signup and sign-in flows at /signup and /signin
• Protected workspace at /app
• Memory explorer with Supabase-backed CRUD at /app/memories
• Supabase-backed API key and settings surfaces at /app/api-keys and /app/settings
• Authenticated memory API at /v1/memories using workspace API keys
• Health endpoint at /api/health
• Resend-ready welcome email endpoint at /api/resend/welcome

The workspace uses Supabase Auth and Postgres with row-level security. Run supabase/schema.sql in the Supabase SQL Editor before using the dashboard.

Supabase configuration

Create a local .env.local and add the project URL plus the anon/publishable key from Supabase Project Settings → API:

NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-or-publishable-key

The Postgres connection string is for migrations or server-only tooling. Never put its password in the browser, NEXT_PUBLIC_* variables, or Git. The app does not need the database password for browser auth.

Resend configuration

Add these environment variables in Vercel after connecting your domain:

RESEND_API_KEY=re_...
RESEND_FROM_EMAIL=Open Memory <hello@your-domain.com>

Signup calls /api/resend/welcome. If the key is not configured yet, signup still succeeds and the endpoint returns a clear configuration response.

Workspace Auth Headers

Signed-in visitors receive both oai-authenticated-user-id and oai-authenticated-user-email. Private Sites require every visitor to sign in; public Sites may also have anonymous visitors, for whom neither header is present.

The user ID is stable for the same user on the same Site and different across Sites. Email and name are intended for display or contact purposes.

SIWC-authenticated workspace sites may also receive oai-authenticated-user-full-name when the user's SIWC profile has a non-empty name claim. The full-name value is percent-encoded UTF-8 and is accompanied by oai-authenticated-user-full-name-encoding: percent-encoded-utf-8.

Treat the full name as optional and fall back to email when it is absent:

import { headers } from "next/headers";

export default async function Home() {
  const requestHeaders = await headers();
  const userId = requestHeaders.get("oai-authenticated-user-id");
  const email = requestHeaders.get("oai-authenticated-user-email");
  const encodedFullName = requestHeaders.get("oai-authenticated-user-full-name");
  const fullName =
    encodedFullName &&
    requestHeaders.get("oai-authenticated-user-full-name-encoding") ===
      "percent-encoded-utf-8"
      ? decodeURIComponent(encodedFullName)
      : null;

  const displayName = fullName ?? email;
  // ...
}

Optional Dispatch-Owned ChatGPT Sign-In

Import the ready-to-use helpers from app/chatgpt-auth.ts when the site needs optional or required ChatGPT sign-in:

• Use getChatGPTUser() for optional signed-in UI.
• Use requireChatGPTUser(returnTo) for server-rendered pages that should send anonymous visitors through Sign in with ChatGPT.
• Use chatGPTSignInPath(returnTo) and chatGPTSignOutPath(returnTo) for browser links or actions.
• Pass a same-origin relative returnTo path for the destination after sign-in or sign-out. The helper validates and safely encodes it.
• Mark protected pages with export const dynamic = "force-dynamic" because they depend on per-request identity headers.

Dispatch owns /signin-with-chatgpt, /signout-with-chatgpt, /callback, the OAuth cookies, and identity header injection. Do not implement app routes for those reserved paths. Routes that do not import and call the helper remain anonymous-compatible.

SIWC establishes identity only; it does not prove workspace membership. Use the Sites hosting platform's access policy controls for workspace-wide restrictions, or enforce explicit server-side membership or allowlist checks.

Use SIWC for account pages, user-specific dashboards, saved records, and write actions tied to the current ChatGPT user. Leave public content anonymous.

Useful Commands

• npm run dev: start the Next.js development server
• npm run build: verify the Next.js production build
• npm run sites:dev: start the legacy Sites/Vinext preview
• npm run sites:build: build the legacy Sites/Vinext target
• npm test: build the starter and verify its rendered loading skeleton
• npm run db:generate: generate Drizzle migrations after schema changes

Learn More

• vinext Documentation
• Drizzle D1 Guide