# Authentication

Send the full key on every call except `GET /openapi.json`.

```
Authorization: Bearer at_live_...
```

The prefix alone is not a key. A missing, unknown, expired, or revoked key returns `401`. A valid key that lacks the scope, or that is called from an IP outside its allowlist, returns `403`.

## Create a key

1. Open the Atomicat app and go to **Settings → API Keys**.
2. Choose a name, the scopes the integration needs, an optional expiry, and an optional IP allowlist.
3. Confirm the email code. The full key is shown once. Store it in a secret manager.

Leave the IP allowlist empty to allow every address. When you set it, use exact IPv4 addresses or IPv4 CIDR blocks for the servers that will call the API.

Revoke a key from the same screen. Revocation takes effect on the next request.

## Scopes

Give a key only the scopes it needs.

| Scope | Allows |
| --- | --- |
| `account:read` | `GET /me` |
| `projects:read` | List and read projects |
| `projects:write` | Create, update, and delete projects |
| `sites:read` | List and read sites |
| `sites:write` | Create sites |
| `pages:read` | List and read pages, templates, quizzes, and the content map |
| `pages:write` | Create, edit, and delete pages and quizzes |
| `pages:publish` | Publish a page. `pages:write` also allows publish |
| `builder:read` | Read the builder. `pages:read` also allows it |
| `builder:write` | Edit nodes and delay. `pages:write` also allows it |
| `funnels:read` | List and read funnels |
| `funnels:write` | Create and update funnels |
| `videos:read` | List and read videos |
| `videos:write` | Update player settings |
| `products:read` | List and read products |
| `products:write` | Create, update, and delete products |
| `leads:read` | Search leads |
| `analytics:read` | Read account counts |

Webhook subscriptions accept any one of `leads:read`, `pages:read`, `products:read`, `funnels:read`, `sites:read`, or `projects:read`.

## Try a request

The reference pages include a playground. Paste your own key there. This site does not store a shared key.

```bash
export ATOMICAT_API_KEY="at_live_..."
curl "https://automation.atomicat-api.com/api/automation/v1/projects?limit=10" \
  -H "Authorization: Bearer $ATOMICAT_API_KEY"
```