Skip to main content
The gateway verifies a JWT bearer token on every documented endpoint. Use one of the confirmed credential paths below, then send it in the Authorization header:
The authenticated identity determines the account, workspace access, and permissions applied by the Registry. Do not pass tenant identifiers as a substitute for authentication.
Preview. Credential availability and workspace access depend on your organization. Confirm the resolved identity before running a write.

​
Choose a credential path

Request an appropriately scoped credential through your organization’s access process. The public documentation does not create, reveal, or rotate tokens. The credential owner is responsible for replacing a token that is revoked, expired, or exposed.

​
Token handling

  • Load local tokens from an ignored .env.local file or an approved secret manager.
  • Store CI tokens in encrypted GitHub Actions secrets.
  • Never put tokens in URLs, examples, logs, screenshots, browser local storage, or committed .env files.
  • Rotate a token immediately if it appears in source control or build output.
atlanai auth status identifies the credential source and resolved account without printing the credential. It does not prove that the identity has permission for every workspace or operation, so make a read in the target scope before a write. The v1 site does not include a live API console. Code examples are inert and cannot persist credentials.