Authentication
API keys, OAuth connections, scopes, and which credential to use.
Two kinds of credential, and the difference is not cosmetic.
API keys
A workspace service credential. Whoever holds it acts as the workspace. Only an admin can create one, and the admin chooses its scopes.
curl https://api.atelier201.com/v1/sites \
-H "Authorization: Bearer atelier201_live_..."The secret is shown once, when it is created. Atelier201 stores a hash, so it cannot show it again. If it is lost, revoke it and make another.
OAuth connections
A person’s delegation to a client: an MCP client, or atelier201 auth login. It
carries their identity, so it is also bounded by the workspace’s member ceiling:
an admin decides how much of their own access a member may hand to a robot.
Atelier201 implements OAuth 2.1 with PKCE, dynamic client registration (RFC 7591) and the device flow. Every supported client is public, so there are no client secrets: PKCE replaces them.
Scopes
Grant the narrowest scopes the work needs.
| Scope | Allows |
|---|---|
account:read | Read the workspace, its plan and its credit balance. |
usage:read | Read credit usage over time. |
sites:read | Read sites: files, content, builds, previews, history and domains. |
sites:write | Create sites, edit files and content, upload media, build and share previews. Nothing becomes public. |
sites:publish | Publish, roll back or take a site offline, and delete a site. This changes what visitors see. |
domains:write | Connect, check and remove custom domains, and choose a site’s main address. |
media:generate | Make images and videos with AI, paid in the workspace’s credits at the price shown before each one. |
sites:write cannot publish, and cannot spend credits: only media:generate can. An agent with it can prepare a complete site, and
the owner decides when it goes live. A scope is the first check, not the only
one: publishing, rolling back, taking offline, deleting a site and changing
domains also need a workspace admin.
A guest site uses neither kind of credential: its short-lived write token opens that one site. See Guest sites.