Base URLs & surfaces

Atlas is a single deployable that hosts several surfaces on separate route trees with separate authentication, so the trust boundary stays legible.

Backend API (BAPI)

• Base: https://api.atlas.dev (the SDK default; self-hosted and per-instance deployments override it).

• Auth: secret key, Authorization: Bearer sk_….

• Paths: everything under /v1/….

• Audience: your servers, background jobs, agents, Terraform. Full administrative surface.

curl https://api.atlas.dev/v1/organizations \
  -H "Authorization: Bearer sk_live_xxx"

Frontend API (FAPI)

• Base: your instance's Frontend API host — a *.fapi.atlasauth.net subdomain, or your own custom domain (e.g. accounts.yourapp.com). The publishable key encodes which instance you are, and the SDKs resolve the host from it.

• Auth: publishable key (x-publishable-key) plus the Atlas session (cookie on web, bearer on native).

• Paths: /v1/client/… (the signed-in me surface and sign-in/sign-up flows), /v1/appearance, /v1/client/environment.

• Audience: browsers and native apps. Never sees a secret.

OIDC / OAuth2, SAML & SCIM

Served on your instance host (the same host as your hosted pages / accounts domain):

• OIDC / OAuth2: /oauth2/authorize, /oauth2/token, /oauth2/userinfo, /oauth2/revoke, /oauth2/introspect, plus discovery at /.well-known/openid-configuration and keys at /.well-known/jwks.json.

• SAML: Atlas as SP (/v1/sso/saml/acs, /v1/sso/saml/:connectionId/metadata) and Atlas as IdP (/v1/saml/idp/sso, /v1/saml/idp/metadata).

• SCIM 2.0: /scim/v2/Users, /scim/v2/Groups, and discovery under /scim/v2/….

Hosted pages

Zero-integration UI, rendered with your instance branding:

• /hosted/sign-in, /hosted/sign-up, /hosted/user and the account-less /hosted/sso-setup self-service flow.

Environments

_live_ and _test_ keys select production and test data on the same host. Keep test keys in development and CI; never ship an sk_ key of any environment to a browser.