Skip to main content
An agent’s identity is the credential it uses to call Atlan as itself, not as the person who registered it. Atlan creates it when you register the agent, so the agent’s sessions, traces, and outputs are attributed to the agent.

​
What an agent identity holds

The identity can reach only the agent’s own workspace, as a member that can create records such as sessions. It can’t manage the workspace or reach other workspaces.

​
Find the controls

Open the agent’s profile, select Settings, and find Identity. It reads Authenticates as its own OIDC client and offers:
  • Rotate API key
  • Rotate client secret
  • Revoke credentials
Who can reach it shows that access follows the workspace, and Your permissions shows what you can do to the agent. You need manage permission on the agent’s workspace to change its credentials; otherwise the section says You do not have permission to change this agent’s credential.

​
Rotate, revoke, and custody

Rules:
  • One credential per rotation. Name api_key or secret; there’s no default and no “both”.
  • One rotation at a time. A second rotation while one is in progress is refused with 409. Retry when the first finishes.
  • A revoked identity can’t be rotated. New credentials mean a new agent.
  • Custody is one-way. If the secret is already in custody, rotate it instead.

​
What archiving does

Archiving an agent revokes its identity too: its key stops authenticating, and the agent’s workspace membership is removed. An archived agent can’t take a new version, and the app has no restore. To use the same agent again, register a new one. See Archive an agent.

​
Agent identity compared with other ways to sign in

Use the agent’s own identity for anything the agent does, so its activity is attributed to it. Don’t run an agent with your personal sign-in or with a shared API key.