Authentication

Every endpoint (except health and the WebSocket handshake) requires a service key passed as a Bearer token:

Authorization: Bearer atsk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Service keys look like atsk_ followed by 64 hex characters.
• Keys are stored hashed (SHA-256) — the full key is shown once, at creation/regeneration. Store it securely; if you lose it, regenerate it.
• A key belongs to exactly one AtlasAccount (your tenant) and can only access that account's instances and data.
• A key is rejected (401) if it is unknown, inactive, expired, or if the owning account is inactive, suspended, or out of credits.

Your first service key is created from the Atlaas dashboard. Once you have one, you can mint and manage additional keys via the Service keys API.

There is also a privileged master key used by Atlaas operators for /api/admin/* routes. It is not issued to customers and is out of scope here.