Publishable & secret keys

Every instance gives you two kinds of key. Using the right one in the right place is the single most important security habit with Atlas.

Publishable key — pk_

pk_test_…   (Development)
pk_live_…   (Production)

The publishable key identifies your instance to the Atlas Frontend API. It is safe to ship in your frontend — in your JavaScript bundle, in a <script> tag, in a mobile app. It grants only the ability to start authentication flows; it cannot read your user list or change settings.

You'll pass it to the embed script or the SDK:

<atlas-sign-in data-atlas-key="pk_live_your_key"></atlas-sign-in>

import { FapiClient } from '@atlas/js';
const client = new FapiClient({ publishableKey: 'pk_live_your_key' });

Secret key — sk_

sk_test_…   (Development)
sk_live_…   (Production)

The secret key authenticates your backend to the Atlas Backend API. It can read and write everything: users, organizations, sessions, roles. Never expose it in client code, a mobile app, or a public repository. Keep it in a server-side environment variable.

curl https://atlasauth.net/v1/users \
  -H "Authorization: Bearer sk_live_your_key"

Which key goes where

Rotating and revoking keys

• You can create multiple secret keys per instance and give them names (for example, one per service).

• Revoke a key the moment it may have leaked — from API keys in the dashboard. Revocation is immediate.

• Publishable keys can also be rotated; update your frontend when you do.

If a secret key leaks: revoke it immediately, issue a new one, and rotate it in your deployment. Because publishable keys can't read data, a leaked pk_ is not an emergency — but rotate it if you prefer.

Next

Put the publishable key to work and get your first user through the door → Add sign-in to your app.