Connect StateJar to your tools
One setup page per tool: MCP clients, Claude Code, Codex, OpenCode, OpenClaw, Hermes Agent, the Python and Node SDKs and the CLI.
Help centre
Every concept, control, provider and decline reason in StateJar. Every entry in full on one page. Not found here? Raise a ticket, or see the docs.
Getting started
Reading the Memory State panel
What the sections mean, what the colours mean, and why an empty panel is sometimes correct.
Setting up a provider
The Playground works with no key (StateJar default model). To use your own model, add one key on the API Keys screen; StateJar sends the minimal memory subset to it.
What StateJar is for
A memory layer that refuses to guess, records why it refused, and turns what it remembers into a portable handle.
Your first handle restore
Copy a handle from one session and open that exact memory in another.
Your first session
Sign in, send one message, and read what the six panels tell you about it.
Concepts
Active state vs history
The field holds one value; everything it used to hold is kept separately.
Audit entry
One row per disclosure: what was sent, from which handle, to which model.
Canonical path
The one dotted address a concept resolves to, no matter how you phrase it.
Conflict
Two values asserted for one field, recorded rather than silently resolved.
Decline and _unmapped
A value StateJar refused to store, kept with the reason it was refused.
Dynamic field
A field for a concept nobody wrote a schema for. First-class, not a leftover.
Extraction tier
Three extractors run in order of cost; the cheapest that succeeds wins.
Field
One named slot holding one value, in one section.
Handle
A content address for one exact state: same bytes in, same handle out.
Normalization and base units
Equivalent values are stored identically, so the handle does not depend on phrasing.
Qualifier
The part of a concept that says which end, which side, or which bound.
Reinforcement
Saying the same thing again strengthens it without changing anything.
Retraction
Taking a value back, leaving the field genuinely empty.
Scope: session, user, namespace
Which slice of memory a read or write applies to.
Session
A named conversation thread. State is scoped to it unless you move a handle across.
State
The structured memory for a session at one point in time.
Supersession
A new value replaces the old one; the old one moves to history.
Token savings and its baseline
Three different baselines ship, they answer different questions, and a percentage without its baseline means nothing.
Value type
What kind of thing a value is: money, quantity, date, duration, percent, ratio, identifier, count, text.
The interface
About page
What StateJar is, in three minutes, including what does not work yet.
Accepting an invitation
The page an invitation e-mail links to: choose a password for the account an admin made for you.
Admin console
The admin console's ten pages, who may open them (a console role, two-factor sign-in) and what is never shown.
Admin console — an account's Logins tab
The Logins tab of an account in Users: every sign-in attempt for 90 days, filterable and exportable as CSV, with addresses masked unless your role may see them.
Admin console — Audit log
Every admin action, newest first: who did what to which account, plan, key, flag or role.
Admin console — Data (owner)
The owner's page for an encrypted download of the whole database or one table, and a read-only SQL console.
Admin console — Extraction
The live queue, the failure log, the cloud and local share, the shared cloud keys and the model re-runs.
Admin console — Feature flags
Named on/off switches the server's code reads, created, switched and deleted from the console.
Admin console — Logs
Server errors, the sign-in log and the outbound mail log, without content.
Admin console — Overview
The Overview page's figures and charts, and the rows each one is counted from.
Admin console — Payment providers
Owner only. Enter a payment provider's credentials, switch it on or off and between test and live mode, and make a 1 to 10 rupee test payment.
Admin console — Plans and payments
The price list and its editor, accounts per plan, the payments state, and the history-retention job.
Admin console — Providers and keys
The cloud providers that read messages, their settings and terms, and the shared key rotator.
Admin console — Roles
The permission matrix, the four built-in roles, custom roles, and who holds each.
Admin console — Tickets
The support queue: filter by status, priority, category and assignee, assign, reply, write internal notes and move tickets to resolved and closed.
Admin console — Users
Search accounts, see their last sign-in and sign-in history, add a user by invitation, and suspend, edit, change role or plan, sign out, reset two-factor, revoke keys, export or delete one, singly or in bulk; counts only, never memory.
API Docs screen
The endpoint reference, with samples in curl, Python, JavaScript and Node.
API Keys screen
Provider keys in, StateJar keys out.
Audit Log screen
Every disclosure — chat, queries, manual records and tier-3 extraction calls — across every session, filterable, with replay.
Audit tab
This session's disclosures, newest highlighted.
Billing page
Your plan, the plans you can buy once billing opens, and every order with its receipt; while billing is closed (today) it offers no purchase, and the Android app never does.
Chrome extension (StateJar Memory)
A popup that shows and adds to a session's memory, restores a handle and copies the memory context. Not yet in the Chrome Web Store.
Clear memory
Empty the memory of a scope for testing, without deleting any history.
Confirm your e-mail address
Profile asks an account made with a password to confirm its address with a code we e-mail it, so a later sign-in by e-mail never resets it.
Connect with OpenRouter
Let OpenRouter make a key in your own account for StateJar instead of pasting one; its usage is billed to your OpenRouter credits.
Connected apps and the consent page
The page an MCP client sends you to when it wants to use your memory, what you are allowing, and the list on API Keys where you disconnect an app.
Contact page
How to reach StateJar by email; phone and address are still to be added.
Dashboard
Account-level counts and the most recent savings figure.
Deleting your account
Profile → Delete account removes everything, permanently. The public /delete-account page explains what goes.
Docs (the docs home)
/docs opens with the integrations showcase, then getting started in seven steps, each with a recording of it running, then every docs page.
Docs pages (one per surface)
Each docs page (/docs/<page>.html) uses one template, and each also exists as Markdown at /docs/<page>.md for agents.
Downloading your data
Profile → Download my data saves a JSON copy of everything your account holds, after your password.
Handles tab
Every version of this session's state, newest first.
Light and dark theme
The sun/moon button switches between the light and dark themes; this browser remembers the choice, and until you choose, your device setting decides.
Login methods (admin)
The admin console's Login methods page: a switch per method, the Google and GitHub client credentials, the callback URL.
Memory State tab
Everything currently remembered, by namespace.
Message box
Where you type. Every message goes through the full pipeline.
Model selector
Choose which model answers, grouped by provider.
My tickets page
Ask the StateJar team for help, read its answers and close a ticket; replies also arrive by e-mail.
New session - Continue my memory or Fresh memory
Choose whether a new Playground session continues your account memory or starts as a separate, empty test user.
Payment orders (admin console)
The admin console's Payment orders, on its Plans and payments page — every order, a full refund for a paid one, and the reconcile pass on demand.
Playground
The working screen: chat on the left, the memory inspector on the right.
Pricing page
The plans (Free, Plus, Pro, Business, Enterprise) with their prices; billing is coming soon until a payment provider takes payments, every account is on Free, and the Free plan's limits are enforced.
Privacy page
Your privacy controls, what the service stores, what it never stores, who else sees data, how long it is kept, how to get a copy and how to delete it.
Recovery codes
Ten one-time codes shown once when two-factor sign-in is turned on. Each replaces one authenticator code, once.
Refund policy
How cancellations and refunds will work once paid plans go on sale; no payment is taken today.
Reporting a reply
The Report button under each model reply in the Playground sends that reply to the StateJar team, with a reason, without leaving the page or the app.
Restore a handle
Adopt a previously sealed state into the current session.
Session selector and + New session
Pick a thread, or start an isolated one.
Sessions
Profile's Sessions panel: every browser signed in to your account, and Log out everywhere.
Sign-in activity (admin)
The admin console's Logs → Sign-ins tab: attempts by method and outcome, and the newest rows.
statejar login (sign in from the terminal)
`pip install statejar`, then `statejar login` opens statejar.com/device; approve once and your code has a key.
Terms page
Links the StateJar SDK License (proprietary) and marks the service terms as not yet written.
The declined section
Values StateJar refused to store, each with the reason.
The demos
Two scripted runs that exercise the real pipeline with no provider key.
The handle line and copy button
The address of the state you are looking at.
The integrations showcase
Tabs on the landing page and on /docs for every way to use StateJar (SDK, agent harness, plugins, MCP, command line), each with a snippet to copy, a one-line benefit and its docs page.
The memory label beside the session picker
Which memory the current session uses - your account memory, a fresh separate one, or the demo's.
The seven-stage pipeline tracker
A live trace of the seven stages, with a real sublabel on each.
The sidebar
Seven destinations, and what each is for.
The sign-in link page
/login/link: where a sign-in link lands. Press Sign in; nothing happens until you do.
This help centre
Search, categories, deep links, and a coverage test that keeps it current.
Tier chips
Which extractors ran, how many fields each contributed, and which failed.
Token savings badge
How much smaller the disclosed subset was, against a stated baseline.
Told the model tab
The exact subset, and the memory_context text, sent to the model for the last question.
Try StateJar (the sandbox)
/try lets anyone try the real pipeline without an account; everything in it is deleted at 00:00 UTC.
Turn strip
The line under each of your messages: what it did to memory.
Two-factor sign-in
Optional authenticator-app codes at sign-in, ten one-time recovery codes, and the sign-in lockout. Required for admin accounts.
Ways to sign in
The login page's methods: a code or a link by e-mail, a password, Google or GitHub.
What the model was told
Under each reply: the handle, the fields, the retrieval mode and the exact context text.
Providers
Anthropic
Claude models, direct.
Google (Gemini)
Google's models, direct.
Ollama (local)
Your own Ollama on your own machine, for replies; only on installs that turn SHOW_OLLAMA on, not on statejar.com.
Ollama (remote / cloud)
An Ollama host we call on your behalf. Requires a key.
OpenAI
A direct connection if you already hold an OpenAI key.
OpenRouter
One key, many models including free ones. The easiest place to start.
StateJar's default model
The model the Playground answers with when you have no key of your own — a cloud model through StateJar's provider pool, within an hourly limit; a 503 "busy" when no provider answers.
Working with the API
A background ingest job
The status, and when done the result, of a message read in the background (async, or long).
A code for your own account
POST /api/v1/auth/account/code e-mails the signed-in account an 8-digit code for one purpose (confirm the address, delete, export, 2FA changes).
A token for the cookie's session
Hands a browser that holds only the session cookie the JSON token the console runs on.
Accept an invitation
POST /api/v1/auth/invite/accept {token, password} opens the invitation link an admin sent, sets the account's password and signs in.
Account stats
Counts for the Dashboard, plus the last chat's savings figure.
Admin — accounts
GET /api/v1/admin/users lists and searches accounts with usage counts; GET, PATCH and DELETE /api/v1/admin/users/{id} view one, change its address or plan, or delete it. Never memory content.
Admin — add an account by invitation
POST /api/v1/admin/users/invite {email, role?, plan_id?, name?, note?} makes the account now and mails an invite link; opening it lets the person choose a password.
Admin — an account's counts-only summary
GET /api/v1/admin/users/{id}/export — the admin row, usage against the plan and rows per table, as a file. Never the account's memory.
Admin — an account's sign-in history
GET /api/v1/admin/users/{id}/logins lists an account's sign-ins (method, result, time, browser and system, country, address), filtered and exportable. Addresses are masked unless the role holds users.view_ips.
Admin — an action on several accounts
POST /api/v1/admin/users/bulk {ids, action, reason?, plan_id?, role?} suspends, unsuspends, changes the plan or role of, or exports up to 100 accounts; each is checked and audited on its own.
Admin — collect a database download (owner)
GET /api/v1/admin/data/download/{token} — the encrypted file an export made, once, within 10 minutes, by the owner who made it.
Admin — disable an account
POST /api/v1/admin/users/{id}/disable suspends an account; nothing it owns is changed.
Admin — download the whole database (owner)
POST /api/v1/admin/data/export — the whole database as SQL, or one table as CSV or JSON, encrypted with a passphrase you type. Owner only, fresh two-factor code, single-use link.
Admin — enable an account
POST /api/v1/admin/users/{id}/enable lifts a suspension.
Admin — extraction queue and failures
GET /api/v1/admin/extraction — the live ingest queue, the failure log, the cloud and local share, the cloud keys' counters and the model re-run queue. No message, no session name, no job's error text.
Admin — feature flags
GET, POST /api/v1/admin/flags and PATCH, DELETE /api/v1/admin/flags/{id} — named switches code reads with is_enabled(key, default). Every change audited.
Admin — give or take an account's role
PUT /api/v1/admin/users/{id}/role {"role": slug} makes an account an admin, support, viewer or a custom role; DELETE takes the role away. Owners are never changed here.
Admin — read-only SQL console (owner)
POST /api/v1/admin/data/query — one SELECT, run as a database user that can only read. Owner only, fresh two-factor code; 500 rows, 5 seconds. The query is kept, its results never.
Admin — recent console queries (owner)
GET /api/v1/admin/data/queries — the last 50 SQL console queries as typed, with outcome, row count and time; never their results.
Admin — reset an account's two-factor sign-in
POST /api/v1/admin/users/{id}/reset-2fa deletes the authenticator secret and recovery codes and signs the account out, for someone locked out of their authenticator.
Admin — retry waiting model re-runs now
POST /api/v1/admin/extraction/retry-now makes the model re-runs backing off in the answering process ready at once. Failed jobs are not re-run: their messages were never kept.
Admin — revoke an account's developer keys
POST /api/v1/admin/users/{id}/revoke-keys revokes every developer key of an account; they stop working on the next request.
Admin — roles and permissions
GET, POST /api/v1/admin/roles and PATCH, DELETE /api/v1/admin/roles/{id} — the permission list, the built-in roles (owner, admin, support, viewer) and custom roles with any set of permissions.
Admin — server errors
GET /api/v1/admin/errors lists recent server errors by route template, with counts.
Admin — sign an account out everywhere
POST /api/v1/admin/users/{id}/logout ends every session and console token of an account now. Developer keys keep working.
Admin — the admin audit log
GET /api/v1/admin/audit lists every admin action: who, what, on which account or row, when.
Admin — the database's tables (owner)
GET /api/v1/admin/data/tables — the table names a download can hold, and whether the SQL console's read-only database user is set up. Owner only.
Admin — the overview
GET /api/v1/admin/overview — accounts, memory operations, model readings by side and model, the queue, server errors, the cloud cost estimate, model and server health. Aggregates only.
Allow or deny an OAuth request
Your decision on the consent page: allow issues a one-use ten-minute code bound to the app, deny sends it access_denied; either way you are sent back to the app.
Am I an admin?
GET /api/v1/admin/status answers whether the signed-in session holds a console role, which role and permissions, and whether two-factor sign-in is on.
An account's usage against its plan (admin)
Memory operations this month vs the plan's allowance, active keys vs the plan's count, retention — counts only.
Approve a terminal sign-in
Issue a one-year developer key for the device and park it for the terminal to collect; the browser never sees the key.
Ask for a sign-in code
Sends an 8-digit one-time code to an e-mail address. Always answers 202, whether or not the address has an account.
Ask for a sign-in link
Sends a one-time sign-in link, bound to the browser that asked for it. Always answers 202.
Assign a plan to an account (admin)
Put an account on a plan; its limits apply on the next request through its existing keys.
Audit facets
The distinct values available to filter the audit trail by.
Audit trail
Every disclosure — chat, queries, manual records and tier-3 extraction calls —, filterable by session and scope.
Balance and spend (admin)
GET /api/v1/admin/backup-spend returns each provider's computed spend per day and month against its monthly cap, and the real balance where a plain API key can read one (OpenRouter).
Billing (your plan and orders)
Your plan, the paid period in force, whether payments are open, and your orders newest first, each paid one with its receipt.
Billing config (are payments open?)
Which payment providers take payments, their names, the currency each is asked to charge in, and the mode (test or live); no account needed.
Billing orders (buy a plan)
Create an order for a paid plan (the server takes the price from the plans table and asks the payment provider for a checkout), and read an order back; nothing here activates a plan.
Buying a top-up
An order for a top-up pack, which adds memory operations to this month's limit for an account on the pack's plan.
Cancel an unpaid order
Closes an open, unpaid order at the payment provider and then here, so it can no longer be paid; a paid order is not cancelled, it runs to the end of its month.
Cancelling a subscription
Cancel a monthly subscription at the end of the month already paid for; that month is kept.
Chat
Query, then send the subset to a model and return its reply.
Checkout choices
Which payment gateways are switched on, the currencies each takes, whether it sells subscriptions, the top-up packs on sale and the GST note every price carries.
Clear memory
Empty a memory scope by writing a new empty head; history is kept and the call is audited.
Close a ticket
POST /api/v1/tickets/{id}/close closes one of your tickets; a closed ticket takes no more replies.
Cloud extraction health check
Whether extraction's cloud providers can read a message now; 503 with the reason when none of the enabled ones can.
Cloud providers for extraction (admin)
The provider table behind extraction's cloud path — one row per supported provider with on/off, priority, model, base URL, timeout, a monthly cost limit and the provider's data-use terms; admin-only, every change audited.
Collect the key (terminal poll)
The terminal asks every few seconds whether you approved; the key comes back exactly once.
Compare input cost
The input tokens of the full chat history against the last N messages plus StateJar's memory_context, and what that input costs for one reply model at the listed price. No model call, nothing stored.
Compare input tokens
Count the input tokens of the full chat history against the last N messages plus StateJar's memory_context. No model call, nothing stored.
Confirm a value before it is stored
Answer a question StateJar asked about a value it was unsure of; yes writes it as a new version, no discards it.
Confirm with a fresh code (step-up)
POST /api/v1/auth/stepup — a fresh code from your authenticator app gives a 5-minute token for one sensitive area, such as the owner's database download.
Confirm your account's address
POST /api/v1/auth/account/confirm-email takes a code e-mailed for confirm_email and marks the address confirmed, removing nothing.
Create an account
Create a StateJar account with an email and a password.
Dashboard insights
Aggregates behind the dashboard charts: fields per namespace, declines by reason over time, and handle lineage.
Delete your account
DELETE /api/v1/account removes the account and every row keyed to it, in one transaction. Permanent.
Deny a terminal sign-in
Refuse a pairing you do not recognise; nothing is issued and the terminal is told.
Download a copy of your account
POST /api/v1/account/export returns everything the account holds as one JSON file, table by table, without any credential.
Extraction backup keys (admin)
The key rotator for extraction's cloud providers — many keys per provider, round-robin, cooldowns, per-key counters, a cost estimate and a Test button; masked after saving, admin-only, every change audited.
Extraction health check
Whether extraction can read a message with its model right now; 503 with the reason when it cannot.
Finish Connect with OpenRouter
Hand over the code and state OpenRouter sent back; the server trades the code for a key in the user's own OpenRouter account and saves it.
Generate a StateJar API key
Create a key for calling StateJar from your own code. Shown once.
Health check
Liveness probe.
Ingest a message
Run the memory pipeline on a message: extract, canonicalize, hash, store.
Internal ticket notes (admin)
POST /api/v1/admin/tickets/{id}/notes adds a note only admins can read; it is never returned to the user and sends no mail.
List state versions
Every handle in a session's chain, oldest to newest.
Log in
Exchange email and password for a bearer token.
Log out
Ends this browser's session on the server and clears its cookie.
Log out everywhere
Revokes every session of the account at once, this one included.
Login audit log (admin API)
Counts of sign-in attempts by method and outcome over 30 days, and the newest rows.
Login methods (admin API)
Read and change the switch per sign-in method and the Google/GitHub client credentials.
Look up a pairing code
What the approval page shows before you decide: the device's name, the code's state and the key's lifetime.
Mail (admin, read-only)
Outgoing mail by kind and status for the last 24 hours and 7 days, and the newest failed or refused attempts with their error class — never an address, a name or a body.
Mark a report reviewed (admin)
POST /api/v1/admin/reports/{id}/reviewed marks one report as reviewed; it stays listed after the open ones.
Model catalog
Which models are available to you, grouped by provider.
Monthly subscriptions
Start a recurring monthly plan at a gateway that sells subscriptions; each charged month activates by the same rule as an order.
New recovery codes
Replaces all recovery codes; needs your password and a code from the app.
OAuth token endpoint (MCP)
An app exchanges its code (with the PKCE verifier) for an access token and a refresh token, and later rotates the refresh token. Form-encoded, RFC 6749.
Order receipt
A paid order's receipt (number, date, account, plan and period, price, amount charged, payment reference, refunds), also e-mailed once when the payment arrives.
Pattern 1: Sidecar
You keep your model call; StateJar supplies the memory subset beside it.
Pattern 2: Proxy
StateJar makes the model call for you and returns the reply.
Pattern 3: MCP
Expose StateJar as tools to an MCP-speaking client.
Payment notices (allapi webhook)
Where allapi tells our server an order was paid; a notice is signature-checked and then confirmed by a server-side status query before a plan changes. Off until the adapter is switched on.
Payment notices (Binance Pay webhook)
Where Binance Pay tells our server that an order was paid, closed or refunded; every notice is checked against Binance's signature and our own order before anything changes. Off until a provider is switched on.
Payment notices (Razorpay, Stripe, PayU)
Where Razorpay, Stripe and PayU tell our server about a payment, refund or subscription; a notice is signature-checked, counted once by its event id, and confirmed by a server-side status check before a plan changes.
Payment orders (admin)
Every payment order, newest first, for the admin panel's Payments section; ids, plan, status, amounts, dates and payment references, never anything about the payer.
Payment provider credentials (owner)
The owner enters a payment provider's credentials; they are kept encrypted and shown afterwards as their last four characters only.
Payment provider on/off and test mode (owner)
The owner switches a payment provider on or off and between test mode (the default) and live mode.
Payment providers on and off (admin)
Lists each payment provider with its on/off switch and why it cannot take payments, and switches one on or off; every change is audited.
Payment reconciliation report (admin)
A read-only report per provider: orders by status, money paid and refunded by currency, and what needs a person.
People and relations
A session's everyday facts as rows: the people in your life and what passes between you and them.
Plans (public price list)
The active plans as the admin last saved them; /pricing reads this on every load, so an edit is live without a deploy.
Plans manager (admin)
Create and edit plans — price in INR and USD, operations per month, cloud-extracted messages per month, retention, seats, keys, rate, features; saved in the database, audited, live at once.
POST /sandbox/ask
What a model would be told for a sandbox visitor's question: the same query, with the same audit row, as an account's.
POST /sandbox/jobs/{job_id}
How a sandbox message's reading went: queued, running, done with what was stored, held and declined, or failed.
POST /sandbox/remember
A sandbox visitor's message, secrets removed, read in the background by the same ingest as an account's message.
POST /sandbox/session
Starts a sandbox session for a visitor without an account; the answer's session_id names it in every other sandbox call.
Profile
Read and update the signed-in account's profile. Four optional fields, scoped to the caller.
Provider keys
Save, list and remove the model-provider keys StateJar calls on your behalf.
Query memory
Retrieve the minimal subset relevant to a question, plus a prompt-ready context string. No model call.
Re-enter a code for payment credentials (owner)
The owner re-enters a two-factor code to open the Payment providers page for five minutes, in this session only.
Read a pending OAuth request
What the consent page shows for a request id: the app's name, its redirect host, the scopes in words and your account. Signed-in only.
Read a state by handle
Fetch the exact state a handle addresses.
Reconciliation report (CSV)
Every order as one CSV row, with what was refunded and what needs a person, to compare with each gateway's own settlement report.
Record a client-side disclosure
Log a disclosure your client made without going through /chat.
Refund an order (admin)
Refunds a paid order, in full or in part, through the payment provider or as money already sent back by hand; the plan ends when the refund is confirmed.
Region hint (India or elsewhere)
A hint about the visitor's country, from a header a CDN or proxy may add; the pricing page uses it to show rupees and national gateways first. Never a gate.
Register an MCP client (OAuth)
Dynamic Client Registration (RFC 7591) for the MCP server's OAuth sign-in: an app registers its name and redirect addresses and gets a client id.
Replay a disclosure
Reconstruct exactly what was disclosed for one audited response.
Reply to a ticket
POST /api/v1/tickets/{id}/replies adds your message and up to 3 attachments to one of your tickets.
Reply to a ticket (admin)
POST /api/v1/admin/tickets/{id}/replies answers a user's ticket and e-mails them; the first reply moves an open ticket to in progress.
Report a reply
POST /api/v1/reports sends the StateJar team a model's reply you found offensive, harmful or wrong, without leaving the app.
Reports of replies (admin)
GET /api/v1/admin/reports lists the replies people reported, open ones first, with how many are open.
Restore a handle
Adopt a sealed state into a session, verifying it on the way in.
Revoke an OAuth token
An app gives a token back (RFC 7009): a refresh token takes its whole family with it; an access token goes alone. Always 200.
Run history retention now (admin)
Runs the daily history-retention job at once and returns its counts; the job deletes memory versions and audit rows older than each account's plan window, never a session's current head.
Run the payment reconcile pass (admin)
Asks the payment provider about every open order and pending refund now, applying what it says through the same checks as a notice; it also runs by itself.
Seats (organisation members)
The people an account owner lets into their organisation, counted against the plan's seats; adding one past the count is refused with 403 plan_seat_limit.
Server panel (admin, read-only)
Disk, memory, CPU load, uptime, each container's status and memory, the last backup, certificate expiry, the deployed commits — from a file the host writes every minute.
Session turns
Per-turn provenance for a session. Contains no message text, by design.
Sign in — second step
Exchanges the mfa_token from /auth/login and a code for a session token.
Sign in with Google or GitHub
Starts the provider's sign-in flow (state, PKCE, nonce) and sends the browser to the provider.
Start a terminal sign-in
What `statejar login` calls first — a pairing code for the browser and a secret for the terminal.
Start an OAuth sign-in (MCP)
Where an MCP client sends your browser: the request is checked (PKCE S256, exact redirect, the MCP resource), stored for ten minutes, and the consent page opens.
Start Connect with OpenRouter
Begin OpenRouter's OAuth PKCE flow for the signed-in account and get the address of OpenRouter's authorization page.
Start two-factor setup
Creates a new authenticator secret and returns it once, with its otpauth link and a QR code.
Support tickets
POST /api/v1/tickets files a support ticket; GET /api/v1/tickets lists yours and GET /api/v1/tickets/{id} reads one with its thread.
Support tickets (admin)
GET /api/v1/admin/tickets lists the queue with filters; GET and PATCH /api/v1/admin/tickets/{id} read one with its internal notes and change its status, priority or assignee.
Test a backup key (admin)
The "Test key" button — one tiny schema call with the key, 15 seconds at most; the answer is the outcome, raw HTTP status and latency, never the key or the provider's reply.
Test a provider connection
Check a saved key really works, before you need it live.
Test payment (owner)
The owner makes a 1 to 10 rupee order through a payment provider for their own account, to see its QR or payment link; it never activates a plan.
The hosted MCP server
StateJar's memory as Model Context Protocol tools at https://statejar.com/mcp, with a developer key or an OAuth sign-in as the credential.
The provider's return
Where Google or GitHub send the browser back; checks the flow, finds or creates the account, redirects to the console.
Ticket assignees (admin)
GET /api/v1/admin/tickets/assignees lists the accounts a ticket can be assigned to: those whose role holds tickets.manage.
Ticket attachments
GET /api/v1/tickets/{id}/attachments/{attachment_id} downloads an attachment of your own ticket; png, jpg, pdf and txt only, 5 MB each, 3 per message.
Ticket attachments (admin)
GET /api/v1/admin/tickets/{id}/attachments/{attachment_id} downloads an attachment for a role holding tickets.read; each download is audited.
Tokens and dollars saved
What StateJar sent to a model against what sending the whole memory state would have cost, from your own audit rows and verified states, with StateJar's extraction cost beside it.
Top-up packs (admin)
The owner's top-up packs (extra memory operations for a plan's month): list them, add one, change its price or take it off sale.
Turn off two-factor sign-in
Needs your password and a current code (or a recovery code); removes the secret and every recovery code.
Turn on two-factor sign-in
Confirms setup with a 6-digit code; returns ten one-time recovery codes, once.
Two-factor status
Whether two-factor sign-in is on for your account, how many recovery codes are left, and whether this session passed a code.
Usage
Aggregate disclosure volume across your audited calls.
Use a sign-in link
The page's POST that turns a link's token into a session. Never on the mail scanner's GET.
Verify a sign-in code
Exchanges the e-mailed code for a session; creates the account on its first verified code.
What the account's forms need
GET /api/v1/auth/account says whether the account has a password it set, whether its address is confirmed, whether 2FA is on and whether codes can be e-mailed.
Which account is this key? (whoami)
`statejar whoami` — the account, label and expiry behind the presented key, never the key.
Which sign-in methods are on
Public: the methods the admin has enabled, for the login page.
Your connected apps
The apps this account connected through OAuth, with their scopes and last use; disconnecting one revokes every token it holds for you.
Your sessions
Lists the account's live sessions, masked, and which one is this browser's.
Your StateJar API keys
List the keys you have generated, and revoke one.
Settings
ADMIN_EMAILS
Comma-separated emails whose accounts are the admin console's owners. Checked on the server on every request.
AES_KEY
Environment variable AES_KEY. Default: change-me-32-bytes-key-required!
ANTHROPIC_BASE_URL
Environment variable ANTHROPIC_BASE_URL. Default: https://api.anthropic.com/v1
APP_ENV (which deployment this is)
Which deployment the backend is, production or staging, as the deploy passes it; empty on a developer's machine. Payments' test mode is refused in production.
AUTH_LINK_SECRET
The key under which sign-in codes and link tokens are hashed before they are stored. Made once on the server; empty disables e-mail sign-in.
BACKUP_GEMINI_MODEL
The Gemini model the extraction backup asks.
BACKUP_OPENROUTER_MODEL
The OpenRouter model the extraction backup asks.
BACKUP_PROVIDERS
The master switch of extraction's cloud path and the providers that start enabled; empty = no cloud provider is asked.
BILLING_PUBLIC_URL
The site the payment provider sends the buyer back to after its checkout (<url>/billing?order=<id>), and the links in receipts.
BILLING_RECONCILE_ENABLED
Whether the API runs the payment reconcile pass by itself (true, the default), asking the provider about open orders and pending refunds.
BILLING_WEBHOOK_BASE
The public API base the payment provider's notices are sent to (<base>/billing/binance/webhook), given to the provider with each order and refund.
BINANCE_PAY_API_KEY
The Binance Pay merchant API key; a server secret written by the deploy from a GitHub secret, never shown, logged or stored in the database.
BINANCE_PAY_BASE_URL
Where the server calls Binance Pay — its documented host in live mode, a stand-in on the server's own machine in test mode.
BINANCE_PAY_FIAT_CURRENCY
Which of a plan's prices Binance Pay is asked to charge, INR (the default) or USD; Binance converts it into USDT or USDC at its own rate.
BINANCE_PAY_SECRET_KEY
The Binance Pay merchant secret that signs every request; a server secret written by the deploy from a GitHub secret, never shown, logged or stored.
BUILTIN_GATE_DIR
The directory the backend processes share to keep extraction off the development local model while a reply runs (none runs on statejar.com).
BUILTIN_LLAMA_ADAPTER
The LoRA adapter llama-server holds beside the base model, by its tag; empty means none.
BUILTIN_LLAMA_FORM
Which of Ollama's two request forms the backend sends llama-server: chat or completion.
BUILTIN_LLAMA_PARAMETERS
The served model's own sampler values, as Ollama reads them, sent with every request to llama-server.
BUILTIN_LLAMA_PROPOSER_SLOT
The llama-server slot extraction's proposals are pinned to, so replies and the verifier go first; -1 lets the server pick.
BUILTIN_LLAMA_URL
Development and eval only: where llama-server answers for the development local model when BUILTIN_SERVER is llama-server; a private address.
BUILTIN_MAX_IN_FLIGHT
How many development-local-model replies (none runs on statejar.com) one backend process generates at once; the rest wait up to 20 s, then 503.
BUILTIN_MODEL
Development and eval only — a local Ollama model extraction v3 can read with; empty (the value in every deployed environment) means StateJar runs no model of its own.
BUILTIN_OLLAMA_URL
Development and eval only: where a hand-built Ollama answers for the development local model; a private address, never a user's daemon.
BUILTIN_SERVER
Which server holds the development local model: Ollama, or llama-server on its own with one base model and one adapter.
CLOUD_DEFAULT_PROVIDER_CAP_USD
The monthly cost cap, in US dollars, of every cloud provider that has no limit of its own; at the cap the provider is skipped until the month turns.
CLOUD_REPLIES_PER_HOUR
How many replies per account per hour StateJar's default model answers; HTTP 429 after that.
CLOUD_WATCH_ENABLED
Whether each backend process watches extraction's cloud providers, so the cloud health check knows whether they can read.
CLOUD_WATCH_INTERVAL_S
How old a cloud provider's newest outcome may be before the watcher probes it; at most one probe per provider in this time.
CONTEXT_BUDGET_TOKENS
Environment variable CONTEXT_BUDGET_TOKENS. Default: 200. The most a memory context sent to a model may cost, in tokens; 0 turns the cap off.
CORS_ORIGINS
Environment variable CORS_ORIGINS. Default: localhost:5173, statejar.vercel.app, statejar.com
DB_URL
Environment variable DB_URL. Default: mysql+pymysql://root:@localhost:3306/statejar
EMAIL_SIGN_IN
Whether this server e-mails codes at all — sign-in codes and links, and an account's own codes. Off on the servers until a PR turns it on.
EXTRACTION_PRIMARY
Which side reads a message first — the enabled cloud providers (the default) or, in development and eval only, a local model; no deployed environment runs a local model.
EXTRACTOR_BACKUP_AFTER_S
How long a message a client waits for gives the first-tried side (the cloud providers by default) before the other side is asked (seconds).
EXTRACTOR_BACKUP_JOB_AFTER_S
How long a background reading gives the first-tried side before the other side is asked (seconds).
EXTRACTOR_LLM_FALLBACK
Environment variable EXTRACTOR_LLM_FALLBACK. Default: False
EXTRACTOR_LLM_FALLBACK_MODELS
Environment variable EXTRACTOR_LLM_FALLBACK_MODELS. Default: openrouter/anthropic/claude-haiku-4.5,openrouter/google/gemini-2.5-flash
EXTRACTOR_LLM_MODEL
Environment variable EXTRACTOR_LLM_MODEL. Default: openrouter/openai/gpt-4o-mini
EXTRACTOR_MODE
Environment variable EXTRACTOR_MODE. Default: auto
EXTRACTOR_V3_BACKGROUND_CHARS
Messages longer than this are read in the background (202 and a job); default 3000.
EXTRACTOR_V3_CLOUD_VERIFIER_MODEL
A stronger cloud model for extraction's verify step only; off by default.
EXTRACTOR_V3_GLINER
A GLiNER checkpoint for extraction v3's span proposals; empty means none.
EXTRACTOR_V3_HOLD_TURNS
How many further messages a held fact waits to be said again; default 5.
EXTRACTOR_V3_JOB_TIMEOUT_S
Seconds a background ingest waits for one model call; default 300.
EXTRACTOR_V3_MAX_IN_FLIGHT
Extraction calls one backend process may have on the development local model at once; default 2.
EXTRACTOR_V3_MODEL
The model extraction v3 asks; empty means the built-in model.
EXTRACTOR_V3_PROPOSER_LORA_SCALE
The adapter's scale on extraction v3's proposals when llama-server holds one; the verifier and replies use 0.
EXTRACTOR_V3_TIMEOUT_S
Seconds extraction v3 waits for one model call while a client waits; default 60.
EXTRACTOR_VERSION
Which extractor reads messages: rules (the rule tiers) or v3; default rules.
GEMINI_BASE_URL
Environment variable GEMINI_BASE_URL. Default: https://generativelanguage.googleapis.com/v1beta
GEO_COUNTRY_HEADER
The request header in which the edge states a visitor's country. Empty (default) = a sign-in's country is recorded as unknown; no address is ever sent to a location service.
GST_RATE_PERCENT
The total GST rate used for the tax lines once a GSTIN is set (default 18). Split into CGST and SGST halves within the supplier's state, IGST otherwise. The accountant confirms it.
GST_SAC_CODE
The SAC printed on the invoice. Empty (the default) prints "To be confirmed by the supplier's accountant"; the code is never guessed.
GST_SUPPLIER_GSTIN
The supplier GSTIN. Empty (the default) means not registered: receipts say "GSTIN: not yet registered" and "GST not charged: supplier not registered", and no tax line is computed. Set only after GST registration; a value that is not a valid GSTIN shape is ignored.
GST_SUPPLIER_NAME
The seller name printed on a receipt and invoice. Default `StateJar`.
INGEST_WAIT_S
Seconds a recall waits for the session's unfinished ingests; default 5.
JWT_SECRET
Environment variable JWT_SECRET. Default: change-me
MAIL_FROM
The one address StateJar's mail comes from; the mail server accepts exactly this envelope sender.
MAIL_MODE
How this server sends e-mail — smtp through StateJar's own mail server, log (nothing sent, one line in the log without the body), or off.
MAIL_PER_ADDRESS_PER_HOUR
Messages to one address within an hour before the backend refuses to send another (429 mail_rate_limit).
MAIL_SMTP_HOST
The host the backend hands outgoing mail to when MAIL_MODE is smtp — the mail container's alias on the private network.
MAIL_SMTP_PORT
The port of the mail container the backend connects to — 25 inside the private network.
MAIL_SMTP_TIMEOUT_S
How many seconds one hand-over to the mail server may take before it counts as failed.
MCP_ALLOWED_HOSTS
The Host headers the MCP server answers; any other host gets 421 (DNS-rebinding protection).
MCP_ENABLED
Whether the API serves the hosted MCP server at /mcp (default true).
MCP_ISSUER_URL
Where the MCP server's bearer tokens come from; they are developer keys made in the API keys page.
MCP_PUBLIC_URL
The URL the MCP server names as its resource in its discovery document.
MCP_RATE_PER_MIN
MCP requests one developer key may make per minute in one API process (default 240); then 429.
ML_MODEL_DOWNLOADS
Environment variable ML_MODEL_DOWNLOADS. Default: False
MODEL_WATCH_ENABLED
Whether each backend process checks every minute that extraction's model is loaded, and loads it when not.
OAUTH_ACCESS_TOKEN_MINUTES
How long an OAuth access token for the MCP server lives (default 60 minutes).
OAUTH_REFRESH_TOKEN_DAYS
How long an OAuth refresh token lives before the app must sign in again (default 30 days); each one works once.
OLLAMA_BASE_URL
Environment variable OLLAMA_BASE_URL. Default: http://localhost:11434
OPENAI_BASE_URL
Environment variable OPENAI_BASE_URL. Default: https://api.openai.com/v1
OPENROUTER_BASE_URL
Environment variable OPENROUTER_BASE_URL. Default: https://openrouter.ai/api/v1
OPENROUTER_OAUTH_CALLBACK_URL
The page OpenRouter sends the browser back to after Connect with OpenRouter. Default empty, meaning MCP_ISSUER_URL + /connect/openrouter.
PAYMENTS_ENABLED_PROVIDERS
Which payment providers take payments, comma-separated; empty (the default, and every environment today) means none, so no plan can be bought.
PAYMENTS_MODE
test (the default) runs payments against a stand-in on the server's own machine, with no money moved; live talks to Binance Pay's own host and takes real payments.
PUBLIC_API_URL
The public origin of this API, for the OAuth callback URL shown in the admin panel.
PUBLIC_SITE_URL
The website a link in an e-mail opens (never the API host).
RATE_LIMIT_ENABLED
Environment variable RATE_LIMIT_ENABLED. Default: True
READONLY_DB_URL
The database URL of a user that can only read (statejar_ro), used by the owner's SQL console and database download. Set by the deploy.
RETENTION_JOB_ENABLED
Whether the API process runs the daily history-retention job (default true); off only in tests or when another process runs it.
RETRIEVER_FULL_STATE_TOKENS
Environment variable RETRIEVER_FULL_STATE_TOKENS. Default: 400. Up to this size a question is given your memory whole; a statement or a task only the fields it bears on.
RETRIEVER_SEMANTIC
Environment variable RETRIEVER_SEMANTIC. Default: False
SANDBOX_ACCOUNT_EMAIL
The address the sandbox's visitor accounts are named after (default sandbox@statejar.com); signup refuses it and every sandbox+ form of it.
SANDBOX_DAILY_CAP
Sandbox actions a day for all visitors together (default 500): new sessions, messages and questions; one more answers 429 until 00:00 UTC.
SANDBOX_ENABLED
Whether the sandbox at /try is open (default true); false answers 404 to every sandbox call.
SANDBOX_MAX_CHARS
The longest message the sandbox takes, in characters (default 500); a longer one answers 422.
SANDBOX_PER_IP_PER_HOUR
Sandbox requests an hour per client address (default 30); one more answers 429.
SERVER_STATUS_FILE
Where the backend reads the host-written status JSON for the admin server panel; absent = the panel says so.
SHOW_OLLAMA
Environment variable SHOW_OLLAMA. Default: False
TICKET_UPLOAD_DIR
The directory where support-ticket attachments are stored, outside every served path; empty means a ticket-files folder beside the backend.
The demo
The 17-turn demo: the scenario
A Wayanad relief operation, built one fact at a time over seventeen turns.
The 17-turn demo: what each marked turn shows
Three turns are marked because they demonstrate the behaviours people doubt.
The 17-turn demo: what to watch
Four things on the right-hand side, and what each proves.
Troubleshooting
A value stored under an unexpected field
The value is there, but under a field name you did not expect.
A value you stated was not stored
You said something with a number in it and the Memory State panel does not show it.
Amber 'unavailable' chip
A tier chip is amber and reads *unavailable*.
Chat history missing on another device
You sign in elsewhere and the memory is there but the conversation is gone.
Handle restore returns different state
You restored a handle and the state is not what you expected.
No LLM chip appears
You expected [tier 3](#tier.llm) to run and there is no `llm` chip — only `rules`.
Ollama: blocked by origin policy
Ollama is running and `curl` works, but the browser cannot reach it.
Ollama: connection refused
The local Ollama card reports the daemon is not reachable.
Rate limit errors
A request fails with a rate-limit error.
Sign-in lockout
Ten wrong passwords or codes for one email address in 15 minutes lock sign-in for that address for 15 minutes.
FAQ
Does StateJar save tokens?
Only on long chats. On a short chat the memory block costs more than the history it replaces; the measured totals are 17 turns -72.8% and 40 turns +3.7%.
How do I get help from the team?
Search this page first; if the answer is not here, raise a ticket from My tickets. Replies arrive in the ticket and by e-mail.
How is this different from ChatGPT memory?
How is this different from built-in model memory?
How is this different from RAG?
How is this different from RAG?
Is my data used for training?
Not by StateJar. But your messages are sent to cloud model providers to be read, and each provider's own terms apply to what they receive.
What do the plans cost, and can I pay yet?
Free forever, Plus, Pro, Business and Enterprise; billing is coming soon, so every account is on Free today and the Free limits are enforced.
What happens if StateJar is down?
What happens if StateJar is down?
Where is my chat history stored?
Where is my chat history stored, and why not on the server?
Which model reads my messages?
StateJar runs no model of its own. Extraction and the default Playground reply go to cloud providers, paid Gemini first, then Mistral, then OpenRouter; your own key goes to your provider.
Why did it not remember something I said?
Why did it not remember something I said?
Why is my token savings negative?
On a short chat StateJar sends more tokens than the plain history; it only comes out ahead as a chat grows. The measured figures, with what was counted.
Reference
Changelog
User-visible changes, newest first, grouped by release.
Conflict: user rejected X in favour of Y
You explicitly swapped one option for another, and both are recorded.
Declined: funds on hand
You said how much money you have, not what it is for; StateJar asks whether it is your budget instead of assuming.
Declined: low_confidence
The tier that proposed it was not sure enough for that field.
Declined: no currency signal
A number with a ceiling word but no currency ("under 50000") is asked about as a budget, never stored as one.
Declined: not an assertion
The clause was a question, a negation or a retraction, not a claim.
Declined: rejected_value
The field exists, but the value is the wrong kind of thing.
Declined: typo corrected
A money concept that only exists because a misspelling was corrected ("slary") is confirmed with you, not stored.
Declined: unclaimed_money
An amount of money was stated without saying what it is, so it was not stored.
Declined: unknown_key
Nothing in the registry claims that field name.
Glossary
Every term used anywhere in the product, alphabetical, each linking to its full entry.
Tier 1: rules
Deterministic patterns. Free, exact, narrow, identical on every machine.
Tier 2: GLiNER2
Schema-guided neural extraction for what the patterns missed.
Tier 3: LLM extraction
The rule pipeline's old third tier, off on statejar.com; extraction v3 reads with the cloud providers instead. StateJar runs no model of its own.
Unresolved: not provided
A field was named but no value was given.
Unresolved: pending
A decision is explicitly outstanding.
Unresolved: user unsure
You said you were not certain, so nothing was stored as settled.
Value type: Count
A plain number of countable things.
Value type: Date
A point in time.
Value type: Duration
A length of time.
Value type: Identifier
A code that names something rather than measuring it.
Value type: Money
An amount with a currency.
Value type: Percent
A proportion out of a hundred.
Value type: Quantity
A number with a unit of measure.
Value type: Ratio
A relationship between two numbers.
Value type: Text
A value that is words rather than a measurement.
Value type: Unknown
The classifier could not tell what kind of value this is.