> ## Documentation Index > Fetch the complete documentation index at: https://platform.atlan.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > To act on Atlan objects, use the Atlan MCP server at https://api.atlan.com/mcp or the SDK. To install or publish skills from a terminal, use the `aireg` CLI; `aireg --map json` prints its command map. The `atlanai` CLI is deprecated. Run a read-only identity check before any write. > The docs MCP server at /mcp searches these docs only. It cannot read or change Atlan objects. > SDK packages: Python `atlanai` (PyPI) and TypeScript `@atlanai/sdk` (npm). Show Python first, then TypeScript. > These docs cover Atlan AI Registry, Atlan's hosted product. The AI registry specification and aireg CLI are maintained separately. /open-source lists publicly reachable signed installers and explains that the source repository and hosted CLI reference currently require GitHub access. Do not claim the repository or its reference docs are publicly accessible. Use these docs for Atlan-specific setup such as the adapter, sign-in and workspaces. # How agent identity works > Each registered agent signs in as itself. Learn what its credentials are, how to rotate or revoke them, and how they differ from user and API key sign-in. An agent's identity is the credential it uses to call Atlan as itself, not as the person who registered it. Atlan creates it when you register the agent, so the agent's sessions, traces, and outputs are attributed to the agent. ## What an agent identity holds | Credential | What it's for | Who holds it | | - | - | - | | **Client ID** | Names the agent's sign-in client. Shown in **Identity** on the agent's profile when available. It is not a secret and can't authenticate alone. | Anyone who can see the agent. | | **API key** | The agent's machine key, for calls the agent makes as itself. Expires after 90 days. | You. Atlan shows it once, when the agent is created or the key is rotated. | | **Client secret** | Lets the agent sign in as an OAuth client. | Atlan keeps it in custody. | The identity can reach only the agent's own workspace, as a member that can create records such as sessions. It can't manage the workspace or reach other workspaces. ## Find the controls Open the agent's profile, select **Settings**, and find **Identity**. It reads **Authenticates as its own OIDC client** and offers: * **Rotate API key** * **Rotate client secret** * **Revoke credentials** **Who can reach it** shows that access follows the workspace, and **Your permissions** shows what you can do to the agent. You need manage permission on the agent's workspace to change its credentials; otherwise the section says **You do not have permission to change this agent's credential.** ## Rotate, revoke, and custody | Action | What happens | API | | - | - | - | | **Rotate API key** | Atlan issues a new key and shows it once. The old key stops working immediately. | `POST /agent/v1/agents/{agent_id}/identity/rotate` with `{"credential_kind": "api_key"}` | | **Rotate client secret** | Atlan replaces the client secret it holds. Anything using the old secret stops working. | `POST /agent/v1/agents/{agent_id}/identity/rotate` with `{"credential_kind": "secret"}` | | **Revoke credentials** | Both the API key and the client secret stop working on their next request. This can't be undone, and the agent record itself is kept. | `POST /agent/v1/agents/{agent_id}/identity/revoke` | | Move an existing secret into custody | For an agent created before Atlan kept client secrets: Atlan checks the secret works, then keeps it without rotating it. No UI control; API only. | `POST /agent/v1/agents/{agent_id}/identity/custody` with `{"client_secret": "…"}` | Rules: * **One credential per rotation.** Name `api_key` or `secret`; there's no default and no "both". * **One rotation at a time.** A second rotation while one is in progress is refused with `409`. Retry when the first finishes. * **A revoked identity can't be rotated.** New credentials mean a new agent. * **Custody is one-way.** If the secret is already in custody, rotate it instead. ## What archiving does Archiving an agent revokes its identity too: its key stops authenticating, and the agent's workspace membership is removed. An archived agent can't take a new version, and the app has no restore. To use the same agent again, register a new one. See [Archive an agent](/registry/agents/how-tos/archive-agent). ## Agent identity compared with other ways to sign in | | Agent identity | Your user sign-in | API key (service account) | | - | - | - | - | | **Acts as** | The agent | You | The key itself | | **Created by** | Registering the agent | Signing in to Atlan | Any member, from **Settings** > **Developer** > **API keys** | | **Workspace access** | The agent's own workspace only | The workspaces you belong to | Only the workspaces granted to it | | **Credentials** | API key (90 days) and a client secret Atlan keeps | Your sign-in session | An API key with the expiry you choose, or a client secret | | **Managed by** | People with manage permission on the agent's workspace | You | Its creator; organization admins can revoke it | | **Use it for** | Calls the agent makes, such as sending its traces and sessions | Working in Atlan and in tools you sign in to | Scripts, CI jobs, and services that aren't an agent | | **Rotate or revoke** | **Settings** > **Identity** on the agent's profile | Sign out; see [Review sessions and agent access](/admin/security/how-tos/review-personal-access) | [Manage API keys](/admin/security/how-tos/manage-api-keys) | Use the agent's own identity for anything the agent does, so its activity is attributed to it. Don't run an agent with your personal sign-in or with a shared API key. ## Related * [Manage API keys](/admin/security/how-tos/manage-api-keys): Create and rotate API keys for scripts and services. * [Agent profile](/registry/agents/references/profile): The profile's other tabs. * [Archive an agent](/registry/agents/how-tos/archive-agent): Retire an agent and its credentials. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.