Verify sessions on your backend

Atlas sessions are standard JWTs. Your backend proves a request is authentic by verifying that token — locally, against your instance's public JWKS, with no call back to Atlas on the hot path. This is the same design in every backend SDK.

The idea

1. The frontend sends the session JWT (from the __session cookie, or an Authorization: Bearer header).

2. Your backend fetches and caches your instance's JWKS from https://<your-frontend-api>/.well-known/jwks.json.

3. It verifies the token's signature, issuer, and expiry, then reads the claims — sub (user id), org_id, org_role, org_permissions.

Because verification is local, it costs nothing per request and keeps working even if Atlas is briefly unreachable. A revoked session or a permission change takes effect within one token lifetime.

Node (@atlas/backend)

import { AtlasBackend } from '@atlas/backend';

const atlas = new AtlasBackend({
  jwksUrl: 'https://accounts.yourapp.com/.well-known/jwks.json',
  issuer: 'https://accounts.yourapp.com',
});

const auth = await atlas.authenticateRequest(req);
if (!auth.ok) return res.status(401).end();

// auth.claims.sub, auth.claims.org_id, …
if (auth.has({ permission: 'org:billing:manage' })) { /* … */ }

Other languages

Every backend SDK ships the same local session verifier and a typed client over the secret-key Backend API. Point the verifier at your JWKS URL and issuer:

• Python — atlas-backend

• Go — atlas-go

• Ruby — atlas-auth

• PHP — atlas-auth/atlas-php (SessionVerifier)

• Java — net.atlasauth:atlas-java (SessionVerifier)

• .NET — Atlas.Sdk (AtlasBackend)

See the SDK overview for install and a snippet of each.

Calling the Backend API directly

You don't need an SDK — the Backend API is plain REST under /v1, authenticated with your secret key as a bearer token:

curl https://atlasauth.net/v1/users \
  -H "Authorization: Bearer sk_live_your_key"

It covers users, organizations, sessions, roles & permissions, webhooks, enterprise SSO/SAML, SCIM provisioning, and billing — each endpoint scoped to a capability so a key only does what you grant it.