Sign-in & session verification

After sign-in, Atlas issues a short-lived session JWT (rotated automatically). Your frontend sends it on each request; your backend verifies it locally.

sequenceDiagram
  autonumber
  participant U as User
  participant FE as Frontend SDK
  participant A as Atlas FAPI
  participant BE as Your backend
  participant J as JWKS
  U->>FE: Enter credentials
  FE->>A: Authenticate (publishable key)
  A-->>FE: Session JWT (short-lived, rotated)
  FE->>BE: Request + session JWT
  BE->>J: Fetch signing keys (cached)
  BE->>BE: Verify signature & claims
  BE-->>FE: 200 — trust userId, orgId, roles

The client and edge checks are UX; the backend verification is the security boundary. Every backend SDK exposes authenticateRequest(req) / verifyToken(token) returning the verified claims.