Get started
Authentication
Bearer tokens on every request, from a personal token or from OAuth.
Every request carries one credential in the Authorization header. There are no API keys in query strings and no cookies: a request without a bearer token is refused with 401.
http
Authorization: Bearer atx_pat_…Two ways to get a token
| Atrix Token | OAuth | |
|---|---|---|
| Use it for | Your own scripts, CI and servers | Apps and assistants that act for other people |
| Who approves | You, when you create it | The person, on a consent screen |
| Lifetime | 30 days, 90 days, a year, or no expiry | 1 hour, refreshed for up to 90 days |
| Prefix | atx_pat_ | atx_oat_ |
| Revoke | Settings → Atrix Tokens | Settings, or the revocation endpoint |
What a token can reach
A token can never do more than the person who created it. Its scopes narrow what that person can do; they never add to it. Permissions are resolved on every call rather than frozen when the token is made, so taking someone’s access away takes it from all of their tokens at the same moment.
Treat a token like a password
Keep it in an environment variable or a secret manager, never in source control or client-side code. If one leaks, revoke it in settings: it stops working on the next request.