API keys

Which key to use where: secret keys for your server, publishable keys for your app.

Which key to use

Key	Starts with	Use it in	Can
Publishable	`pk_live_ / pk_test_`	Your app	Activate, validate, deactivate, and request offline leases.
Secret	`sk_live_ / sk_test_`	Your server only	Manage products, policies, licenses, and webhooks.

Send either one as a bearer token:

bash

curl https://api.atlasinfra.cloud/v1/products \
  -H "Authorization: Bearer sk_live_..."

Keys only work in their own environment: a _test_ key sees test licenses only.

Publishable keys

Each product has one publishable key per environment, shown on the product page. They're designed to be public: on their own they can only check licenses, and the customer's license key is still required.

Secret keys

Admins and owners create secret keys in API keys. The key is shown once, so store it in your server's secret manager. Never put a secret key in your app or in source control.

Give each key only the access it needs:

Scope	Allows
products:read	View products and policies.
products:write	Create, edit, and archive products and policies.
licenses:read	View licenses, customers, activations, and license history.
licenses:write	Issue, edit, suspend, renew, and revoke licenses; deactivate devices.
webhooks:read	View webhook endpoints and deliveries.
webhooks:write	Create, edit, rotate, and delete webhook endpoints.

You can also give a key an expiry date. If a key leaks, revoke it from the API keys page and it stops working immediately.