Before you begin
- The Administrator role (keys are issued, rotated and revoked by an administrator of the tenant)
- A tool that can send an HTTPS request with an Authorization header
What a key can reach
Every key carries one or more scopes from a fixed list, and each endpoint checks for its scope on every request. Scopes are separate from the role-based permissions your users have in the console.
- RMM and endpoint-management alerts (read, and write for acknowledging or resolving): Tactical RMM, Datto RMM, NinjaOne, ConnectWise Automate, and Tanium. Level is read-only (devices and groups).
- Atlas Vault dashboard tiles: push status tiles onto a company or asset page, and read back the tiles you pushed.
- The Atlas Reach public API: list and inspect devices, run approved library scripts, deploy software through a package manager, install Windows Updates, and read session history and recording metadata. A key can never upload ad-hoc script content or replay a recording.
- Atlas Vault secrets for Reach script runs: lets a script run use a shared Vault credential; every secret it resolves is audit-logged.
Calling Atlas with a key
Send the key as a bearer token: Authorization: Bearer atlsk_… . A key belongs to exactly one tenant, and every request is bound to that tenant's data. To check a new key, call /api/integration/whoami on your Atlas address: it returns the key's tenant, its public prefix, and its scopes. Reach callers can download the OpenAPI description from /api/v1/reach/openapi.json with any valid key.
An invalid, expired or revoked key gets the same 401 Invalid API key response, and a key without the needed scope gets a 403. Requests are rate-limited per key (120 a minute by default), and a limited caller is told how many seconds to wait.
Issuing, rotating and revoking keys
Keys are issued by an administrator of the tenant, signed in to Atlas. The full key is returned exactly once, when it is issued; afterwards Atlas shows only its short public prefix, so store it in your tool's secret store straight away. Rotating a key issues a replacement with the same name and scopes and keeps the old key working for a grace period (60 minutes by default, up to 7 days) so your tool can switch over without an outage. Revoking a key stops it immediately. Every issue, rotation, revocation and use is written to the audit log.
There is no API keys screen in the Atlas console yet: keys are managed through the key-management endpoint while signed in as an administrator. If you need help issuing your first key, contact Atlas support.
Limits and good practice
A tenant can hold up to 100 active keys; revoked keys do not count. Issuing and rotating keys are rate-limited, and a key can carry an optional expiry date. Treat keys like service credentials: give each tool its own key with only the scopes it needs, rotate them on a schedule, and revoke any that are no longer in use.