Skip to main content
Atlas exposes one URL prefix per audience, and each prefix has exactly one authentication method, enforced in middleware. A handler never decides its own auth, and credentials never cross surfaces.

​
API keys

API keys authenticate the REST API (/api/v1). Hosted MCP clients authenticate through Atlas OAuth and never receive an API key. Create and revoke them from the dashboard; each key is shown in full exactly once, at creation. Pass the key as a bearer token:
The x-api-key header is also accepted:
Treat API keys as secrets. They are server-side credentials — never ship them in client-side code or commit them to source control. Each key is rate-limited and carries per-key usage visibility (last used) in the dashboard.

​
Signer tokens

Recipients sign without ever creating an account. Each signing link carries a stateless, HMAC-signed envelope token scoped to a single envelope (and optionally a single signer, with an expiry). A valid signature proves Atlas minted the token. You never construct signer tokens yourself — Atlas issues them in the emailed links. The /api/signer/* surface accepts the token as a bearer token or a token query parameter, and is the only surface with CORS enabled (limited to the apex web origin).
Least-privilege links: every emailed link authorizes exactly one person to do exactly one thing on exactly one envelope. A signer’s link can never expose another participant’s fields or a different envelope.

​
Errors

Authentication failures use the standard error envelope (see Errors):