Architecture at a glance

Atlas has two API surfaces and two SDK types. The frontend SDK (publishable key) renders sign-in and holds the session; the backend SDK (secret key) verifies sessions and calls the management API. Session JWTs are verified locally against the instance's JWKS — no network round-trip per request.

flowchart LR
  subgraph Client["Browser / App"]
    FE["Frontend SDK<br/>publishable key (pk_)"]
  end
  subgraph Server["Your backend"]
    BE["Backend SDK<br/>secret key (sk_)"]
  end
  subgraph AtlasInstance["Atlas instance"]
    FAPI["Frontend API (FAPI)"]
    BAPI["Backend API (BAPI)"]
    JWKS["JWKS<br/>(public keys)"]
  end
  FE -->|"sign-up / sign-in"| FAPI
  FAPI -->|"short-lived session JWT"| FE
  FE -->|"JWT on each request"| BE
  BE -->|"fetch + cache keys"| JWKS
  BE -->|"manage users / orgs"| BAPI

• FAPI is browser-facing, authenticated by the publishable key.

• BAPI is server-facing, authenticated by Authorization: Bearer sk_….

• The backend never calls Atlas to check a session — it verifies the JWT signature against the cached JWKS, so auth is cheap on every request.