Your API keys

Atlas has two API surfaces, and each has its own key. Getting these right is the whole security model, so it's worth one page.

Publishable key — pk_...

The publishable key identifies your instance to the Frontend API (FAPI). It is designed to be public: it ships in your browser bundle or mobile app, and it's what every frontend SDK (@atlas/js, @atlas/react, @atlas/nextjs, Swift, Kotlin, Flutter, …) is initialized with.

import { FapiClient } from '@atlas/js';

const client = new FapiClient({ publishableKey: 'pk_live_your_key' });

A publishable key can only do what an anonymous or signed-in end user is allowed to do — start a sign-in, submit a factor, read the current user. It cannot manage other users or read your instance's data.

Secret key — sk_...

The secret key authenticates your backend to the Backend API (BAPI). It is the full management surface — users, organizations, roles, sessions, SSO, SCIM, webhooks, billing — so it must never appear in client code, a repo, or a browser network tab. Keep it in a server-side environment variable.

curl https://atlasauth.net/v1/users \
  -H "Authorization: Bearer sk_live_your_key"

Every Backend API request is a plain bearer token — no signing, no handshake.

test vs live

Keys are prefixed by environment: pk_test_ / sk_test_ belong to a development instance, pk_live_ / sk_live_ to production. They address different instances with different data, so you cannot accidentally read or mutate production from a development key.

Sessions are JWTs

When a user signs in, Atlas issues a session as a standard JWT. Your backend can verify it locally — with no call back to Atlas — against your instance's public JWKS at:

https://<your-frontend-api>/.well-known/jwks.json

That's how every backend SDK's session verifier works: fetch and cache the JWKS, verify the token's signature, issuer, and expiry, and read the claims. See Verify sessions on your backend.

If a key leaks

Roll it from the dashboard's API keys screen. Rolling a secret key immediately invalidates the old one. For a suspected signing-key compromise, Atlas supports emergency key rotation that drops the old public key with no grace period.