Frontend API overview

The Frontend API (FAPI) is what browsers and native apps talk to. It powers sign-in and sign-up, the signed-in "me" surface (profile, emails, MFA, sessions, organizations), and session-token minting. It is authenticated with a publishable key plus the Atlas session — never a secret key.

• Base: your instance's Frontend API host (*.fapi.atlasauth.net or your custom accounts domain).

• Auth: x-publishable-key: pk_… (or ?publishable_key=) plus the session — an HttpOnly cookie on web, a bearer token on native.

• Paths: /v1/client/…, /v1/appearance, /v1/client/environment.

You will rarely call FAPI by hand. Use an SDK — @atlas/react, @atlas/vue, @atlas/js, the mobile SDKs — which drive these multi-step flows and manage the session for you. The endpoints are documented so you understand what the SDK does and can build a custom UI when you need one.

Booting the client

GET /v1/client        → the current client; session: null for a signed-out visitor (never 401)
GET /v1/client/me     → the signed-in user with emails, linked accounts, passkeys
GET /v1/client/environment  → enabled social providers (and native client ids)
GET /v1/appearance    → the embeddable widget's public theme + enabled strategies

The flow model

Sign-in and sign-up are multi-step attempts. You create an attempt, then advance it — each response carries a status that tells you the next step (verify email, submit a first factor, provide a second factor, complete). This models real-world flows: MFA, magic links, passwordless, OAuth, enterprise SSO, and passkeys all fit the same shape.

• Sign-in & sign-up — the attempt state machine and every first/second-factor method.

• Account management — the me surface: profile, emails, identities, MFA, passkeys, organizations, data export/deletion.

• Sessions & tokens — session listing, multi-session, getToken, and template tokens.

For the full list, see the Frontend endpoint index.

Personal access tokens

A signed-in user can mint a scoped personal access token (uat_) to drive their own account over the me-surface programmatically:

POST /v1/client/me/api_tokens   → mint (secret shown once)
GET  /v1/client/me/api_tokens   → list
DELETE /v1/client/me/api_tokens/:id → revoke

These are session-only and scoped; a revoked token fails closed immediately.