---
title: "Authentication"
description: "API keys, OAuth connections, scopes, and which credential to use."
canonical: "https://atelier201.com/docs/api/authentication"
updated: "2026-11-06"
---

# Authentication

Two kinds of credential, and the difference is not cosmetic.

## API keys

A **workspace service credential**. Whoever holds it acts as the workspace. Only
an admin can create one, and the admin chooses its scopes.

```bash
curl https://api.atelier201.com/v1/sites \
  -H "Authorization: Bearer atelier201_live_..."
```

The secret is shown once, when it is created. Atelier201 stores a hash, so it cannot
show it again. If it is lost, revoke it and make another.

## OAuth connections

A **person's delegation to a client**: an MCP client, or `atelier201 auth login`. It
carries their identity, so it is also bounded by the workspace's member ceiling:
an admin decides how much of their own access a member may hand to a robot.

Atelier201 implements OAuth 2.1 with PKCE, dynamic client registration
([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)) and the device flow. Every
supported client is public, so there are no client secrets: PKCE replaces them.

> **Warning: The ceiling is not a capability boundary**
>
> The member ceiling bounds what a member may delegate to a client. It does not
> restrict what they can do in the web interface: the product has two roles,
> admin and member.

## Scopes

Grant the narrowest scopes the work needs.

| Scope            | Allows                                                                                                |
| ---------------- | ----------------------------------------------------------------------------------------------------- |
| `account:read`   | Read the workspace, its plan and its credit balance.                                                  |
| `usage:read`     | Read credit usage over time.                                                                          |
| `sites:read`     | Read sites: files, content, builds, previews, history and domains.                                    |
| `sites:write`    | Create sites, edit files and content, upload media, build and share previews. Nothing becomes public. |
| `sites:publish`  | Publish, roll back or take a site offline, and delete a site. This changes what visitors see.         |
| `domains:write`  | Connect, check and remove custom domains, and choose a site's main address.                           |
| `media:generate` | Make images and videos with AI, paid in the workspace's credits at the price shown before each one.   |

`sites:write` cannot publish, and cannot spend credits: only `media:generate` can. An agent with it can prepare a complete site, and
the owner decides when it goes live. A scope is the first check, not the only
one: publishing, rolling back, taking offline, deleting a site and changing
domains also need a workspace admin.

A guest site uses neither kind of credential: its short-lived write token opens
that one site. See [Guest sites](/docs/platform/guest-sites).