Authentication

The Atlas Public API authenticates with an API key sent as an HTTP header:

Request Header

X-API-Key: atlas_live_abc123xyz

Every request to /api/v1/public/* must include this header. The key identifies your workspace and determines which content is accessible.

Looking to write, not just read?

Everything above is for the Public API (atlas_live_ keys, read-only). To create, update, publish, or delete content programmatically, see Management API authentication below.

Generating an API Key

Open the Atlas dashboard: https://cms.atlas.latellu.com
Go to Settings → API Keys.
Click Create API Key, give it a name, and save.
Copy the key — it is shown only once.

Sending the Key

Include X-API-Key on every Public API request:

cURL

curl "https://api.atlas.latellu.com/api/v1/public/entries?type=article" \
  -H "X-API-Key: atlas_live_abc123xyz"

fetch (JavaScript)

const res = await fetch(
  'https://api.atlas.latellu.com/api/v1/public/entries?type=article',
  {
    headers: {
      'X-API-Key': process.env.ATLAS_API_KEY,
    },
  }
);
const { data } = await res.json();

Key Scopes

Each API key carries two optional restrictions set at creation time:

Scope	What it controls
Content type whitelist	Limits which content types the key can read. Leave empty to allow all.
Environment	`production` serves only published entries; `preview` also serves drafts (useful for staging sites).

These restrictions are enforced server-side — requests that fall outside the key's scope return a 403 error.

Key Security

Treat an API key like a password. Never commit it to a public repository.
For frontend apps, fetch content server-side (e.g., in a Next.js Server Component or API route) so the key is never exposed to the browser.
Rotate a key immediately from the dashboard if you suspect it has been leaked.
Create separate keys per environment (production vs. staging) so a compromised staging key cannot access production content.

Atlas has two classes of API key, distinguished by their prefix. Both are sent using the same X-API-Key header — the backend derives the key's class (and therefore which base path it can call) from the prefix itself.

Prefix	Base path	Capability
`atlas_live_`	`/api/v1/public/*`	Delivery — read-only. Covered above.
`atlas_mgmt_`	`/api/v1/manage/*`	Management — write (create, update, publish, delete).

A management key lets you create entries, publish/unpublish/archive/schedule them, reorder page blocks, upload media, and more — everything the dashboard's editor can do — from a script, CI job, or AI agent. See the SDK management guide and the Management API reference.

Request Header

X-API-Key: atlas_mgmt_abc123xyz

Management keys are write-capable secrets

A management key can create, change, and delete content, so treat it with the same care as a database credential:

Server-side only. Never ship a management key inside a browser bundle, mobile app, or any client an end user can inspect.
It acts as a bound service actor. Every write made with a management key is attributed to the user who created it, and is enforced by the same RBAC and workspace permissions as if that user made the change from the dashboard. A key cannot do more than its creator could.
Give it an expiry. Management keys carry an expiration date set at creation time — prefer the shortest expiry that fits your workflow and rotate before it lapses.

Minting a management key

Open the Atlas dashboard: https://cms.atlas.latellu.com
Go to Settings → API Keys.
Click New, and choose the Management key type.
Select the scopes the key needs (least privilege — see below) and set an expiry.
Copy the key — it is shown only once.

Scopes

Management keys are further restricted by scope. A request fails with 403 if the key doesn't carry the scope its endpoint requires.

Scope	Grants
`content:write`	Create, update, delete, duplicate, and reorder entries and pages.
`content:publish`	Publish, unpublish, archive, and schedule entries and pages.
`media:write`	Upload and delete media assets.
`schema:write`	Author content types and fields — see the limits below.

schema:write is narrower than it looks

It covers creating a content type, adding a field, editing presentation metadata (name, description, icon, display field, field label, filterable, sortable), reordering fields, and deleting a content type that has no entries.

It cannot rename a field, change a field's type, toggle localizable, is_unique or required, delete a field, or toggle is_block on an existing type. Those either rewrite or invalidate data already stored in entries, so they stay in the dashboard where you see an impact preview first. The restriction is enforced by the request shape of the /manage endpoints — the excluded keys do not exist on them — so no client can work around it.

Scopes are not contagious: a key holding schema:write cannot write entries, and a key that predates this scope does not acquire it. Grant it explicitly, and only to keys that need to build schema.

Error Responses

Status	Meaning
`401 Unauthorized`	`X-API-Key` header is missing or empty.
`403 Forbidden`	Key is valid but does not have access to the requested resource.

401 — Missing API key

{
  "success": false,
  "message": "Unauthorized",
  "code": "UNAUTHORIZED",
  "traceId": "req_a1b2c3d4"
}

403 — Key lacks access to this content type

{
  "success": false,
  "message": "Access to this content type is not allowed for this API key",
  "code": "FORBIDDEN",
  "traceId": "req_e5f6g7h8"
}

See Error Handling for the full response envelope format.

Authentication

On this page