Synthetic Sciences Authentication

generated: '2026-07-21'
method: searched
source: https://docs.syntheticsciences.ai/atlas/authentication
docs: https://docs.syntheticsciences.ai/atlas/authentication
summary:
  types: [http, oauth2]
  http_scheme: bearer
  api_key_prefix: thk_
  oauth2_flows: [browser-login]
schemes:
  - name: BearerToken
    type: http
    scheme: bearer
    description: >-
      Atlas API keys are prefixed `thk_` and sent as `Authorization: Bearer <key>`.
      Minted with `atlas key:create` or in the app; the full secret is shown once.
      Managed via /api/v1/auth/api-keys (create/list/rotate/delete). Intended for
      agents, scripts, and CI. Supports `--expiry-days` for short-lived automation.
    header: "Authorization: Bearer thk_..."
    management_routes:
      - {method: POST, route: "/auth/api-keys", use: create}
      - {method: GET, route: "/auth/api-keys", use: list}
      - {method: POST, route: "/auth/api-keys/{key_id}/rotate", use: rotate}
      - {method: DELETE, route: "/auth/api-keys/{key_id}", use: revoke}
  - name: BrowserLogin
    type: oauth2
    flow: interactive-browser
    description: >-
      Interactive human login: `atlas login` starts a localhost callback, opens the
      Atlas approval page, redeems a one-time token, and writes an API key to the
      active local profile (file mode 0600). Both auth paths resolve to a `thk_*`
      key sent as a bearer token. The legacy MCP-era device-pairing and token-exchange
      flows are retired and now return HTTP 426 Upgrade Required.
    routes:
      - {method: POST, route: /auth/cli/browser/start, use: start browser login}
      - {method: GET, route: /auth/status, use: verify auth}
config_resolution:
  order: ["--api-key <key>", "ATLAS_API_KEY env", "active profile (atlas login)", "root config fallback"]
  env_vars: [ATLAS_API_KEY, ATLAS_BASE_URL, ATLAS_CLI_CONFIG_PATH, ATLAS_LOGIN_TIMEOUT_MS]
  storage: "local profile file (0600) or macOS Keychain (atlas secret:set)"
integrations:
  - {name: GitHub, method: OAuth app install or PAT, routes: [/auth/github/install-url, /auth/github/pat, /auth/github/status]}
  - {name: HuggingFace, method: access token, routes: [/auth/integrations/huggingface]}
  - {name: "Weights & Biases", method: API key, routes: [/auth/integrations/wandb]}
notes: >-
  No OpenAPI/Swagger document is published (the docs expose route tables, not a machine
  spec), so this profile is searched from the official auth docs rather than derived.
  Auth is bearer-key based; there is no documented OAuth scope surface, so no scopes/ artifact.