> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Send a bearer token

> Authenticate to the public Agent Gateway APIs.

The gateway verifies a JWT bearer token on every documented endpoint. Use one
of the confirmed credential paths below, then send it in the `Authorization`
header:

```http theme={null}
Authorization: Bearer <token>
```

The authenticated identity determines the account, workspace access, and
permissions applied by the Registry. Do not pass tenant identifiers as a
substitute for authentication.

<Note>
  **Preview.** Credential availability and workspace access depend on your
  organization. Confirm the resolved identity before running a write.
</Note>

## Choose a credential path

| Environment                    | Use                                                                                  | Verify                                                                                       |
| ------------------------------ | ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- |
| Local interactive work         | Sign in through the CLI with `atlanai auth login`                                    | Run `atlanai auth status`, then make a read-only identity request.                           |
| CI, container, or coding agent | A pre-provisioned API key or bearer token in the environment's approved secret store | Run `atlanai auth status` in the environment and confirm the intended workspace with a read. |

Request an appropriately scoped credential through your organization's access
process. The public documentation does not create, reveal, or rotate tokens.
The credential owner is responsible for replacing a token that is revoked,
expired, or exposed.

## Token handling

* Load local tokens from an ignored `.env.local` file or an approved secret
  manager.
* Store CI tokens in encrypted GitHub Actions secrets.
* Never put tokens in URLs, examples, logs, screenshots, browser local storage,
  or committed `.env` files.
* Rotate a token immediately if it appears in source control or build output.

`atlanai auth status` identifies the credential source and resolved account
without printing the credential. It does not prove that the identity has
permission for every workspace or operation, so make a read in the target
scope before a write.

The v1 site does not include a live API console. Code examples are inert and
cannot persist credentials.