Generate and Manage Atmet API Keys for Your Workspace

API keys let you authenticate requests to the Atmet API from your own scripts, applications, or CI/CD pipelines — without using your personal login credentials. Each key is scoped to a specific workspace and carries the permissions of the member who created it.

Key Format

Every Atmet API key starts with the prefix atmet_ followed by 40 lowercase hexadecimal characters:

atmet_a3f8b2c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9

Your credentials are stored securely and never exposed after creation. This means you must copy the key at the moment it is created. It cannot be retrieved later.

Create an API Key

Open API Keys settings

Navigate to Settings → API Keys in the left sidebar.

Click New Key

Click New API Key in the top-right corner.

Name your key

Enter a descriptive name that identifies what this key is used for — for example, GitHub Actions Deploy or Local Dev Script. Good names make it easier to audit and rotate keys later.

Set an optional expiry date

If you want the key to stop working automatically after a certain date, select an Expiration Date. Leave this blank for a non-expiring key.

Copy the key immediately

After clicking Create, Atmet displays the full raw key exactly once. Copy it to a secure location — a password manager or secrets vault — before closing the dialog.

The raw API key is shown only once at creation time. If you close the dialog without copying the key, you must revoke it and generate a new one. Atmet cannot display or recover the original key.

Use Your API Key

Pass your API key in the Authorization header as a Bearer token on every request. You must also include the x-workspace-id header to identify which workspace the request targets. cURL example:

curl https://app.atmetai.com/api/chats \
  -H "Authorization: Bearer atmet_your_key_here" \
  -H "x-workspace-id: your_workspace_id"

TypeScript / JavaScript example:

const response = await fetch('https://app.atmetai.com/api/chats', {
  headers: {
    'Authorization': 'Bearer atmet_your_key_here',
    'x-workspace-id': 'your_workspace_id',
  },
});
const { chats } = await response.json();

Store your key in an environment variable (e.g. ATMET_API_KEY) rather than hardcoding it in your source files. Read it at runtime with process.env.ATMET_API_KEY in Node.js or the equivalent in your language of choice.

Manage Existing Keys

The Settings → API Keys page lists all keys created in the workspace, showing:

Field	Description
Name	The label you gave the key when you created it
Created	The date the key was generated
Last Used	The last time the key was used to authenticate a request
Expires	The expiry date, or “Never” if no expiry was set

The raw key value is never shown in the list. Only the metadata above is displayed to protect your credentials.

Revoke a Key

Revoking a key immediately invalidates it. Any requests using that key will receive a 401 Unauthorized response.

Open Settings → API Keys

Navigate to the API Keys list.

Find the key to revoke

Locate the key by name or creation date.

Click Revoke

Click the ⋯ menu next to the key and select Revoke. Confirm the action in the dialog.

Security Best Practices

Treat API keys like passwords. Follow these practices to keep your workspace secure.

Never commit keys to source control

Use environment variables or a secrets manager. Add .env to your .gitignore to prevent accidental commits.

Set expiry dates

Short-lived keys reduce the blast radius if a key is ever leaked. Set expiry dates for all keys used in automated pipelines.

Rotate keys regularly

Create a new key, update your application to use it, and revoke the old key on a regular schedule — at minimum every 90 days.

Use one key per application

Create separate keys for each script or service. If one is compromised, you can revoke it without affecting other integrations.

Get Started

Using Atmet

Integrations

Workspace

Help

Generate and Manage Atmet API Keys for Your Workspace

Key Format

Create an API Key

Use Your API Key

Manage Existing Keys

Revoke a Key

Security Best Practices

Never commit keys to source control

Set expiry dates

Rotate keys regularly

Use one key per application

​Key Format

​Create an API Key

​Use Your API Key

​Manage Existing Keys

​Revoke a Key

​Security Best Practices

Never commit keys to source control

Set expiry dates

Rotate keys regularly

Use one key per application

Key Format

Create an API Key

Use Your API Key

Manage Existing Keys

Revoke a Key

Security Best Practices