Authentication¶

Most AtomGit API requests require authentication; requests without credentials only return public data. Every endpoint page states whether anonymous access is allowed and which token types the endpoint accepts.

Access tokens¶

The AtomGit API uses AtomGit user access tokens exclusively. Every endpoint page in this repository points to this token type in its "Supported access tokens" section. Some endpoints (such as search and public repository reads) allow anonymous access, and return non-public content when a token is supplied.

Create a token on the personal access token page and grant only the scopes you need. Store the token in an environment variable or a secret manager — never commit it to a repository.

Three ways to send a token¶

You can pass the same token to the server in any of three equivalent ways. Pick the one that fits your calling scenario.

1. Authorization header (recommended)

curl --location 'https://api.atomgit.com/api/v5/user' \
--header 'Authorization: Bearer {your-token}'

2. PRIVATE-TOKEN header

curl --location 'https://api.atomgit.com/api/v5/user' \
--header 'PRIVATE-TOKEN: {your-token}'

3. access_token query parameter

curl "https://api.atomgit.com/api/v5/users/{username}?access_token={your-token}"

The query parameter leaves the token in the URL, where logs, proxies, and shell history can capture it. Use it only when you cannot set headers.

Missing or invalid tokens¶

When credentials are missing or invalid, the endpoint returns 401:

{
  "message": "401 Unauthorized"
}

When the token is valid but lacks permission, the endpoint returns 403; for example, when the user is not allowed to delete the project.

Related pages¶

• OpenAPI quick start: API hosts, version prefix, your first request, and pagination
• Error handling: full status code reference and rate limit details
• API reference: browse all endpoints by category