REST API authentication

Atria's REST API uses bearer API tokens. Every request must include a valid token in the HTTP Authorization header and must be sent over HTTPS.

Generating an API Token

To generate a token, follow these steps in the Atria portal:

1. Sign in to Atria with an account permitted to manage API tokens.
2. Navigate to My Account in the top right menu.
3. Open the API Tokens tab.
4. Click the Generate button.
5. Copy the token immediately. For security, it will only be shown once.

Copy and protect the token

The token is shown only when it is generated. Treat it like a password: store it in an approved secret store, never commit it to source control, and do not include it in screenshots, command history, or logs.

Using the Token in Requests

Include the token in the HTTP Authorization header as a Bearer token.

The API base URL is normally:

https://<atria-host>/api

Example with curl

curl "https://atria.example.com/api/v2/customers" \
  --header "Authorization: Bearer $ATRIA_API_TOKEN" \
  --header "Accept: application/json"

Set ATRIA_API_TOKEN from your secret store before running the command. Avoid putting the token directly in the command because shells can retain command history.

Example with Atria.Tools

The PowerShell SDK accepts the same token:

$secureToken = Read-Host 'Atria API token' -AsSecureString
$token = [Net.NetworkCredential]::new('', $secureToken).Password

try {
    Connect-AtriaApi `
        -AuthToken $token `
        -apiBase 'https://atria.example.com/api'
}
finally {
    Remove-Variable token -ErrorAction SilentlyContinue
}

See Connect-AtriaApi for module-specific security notes.

Token Expiry

The token's expiry is displayed on the API Tokens page. Generate a replacement before a production token expires, update the consuming secret store, verify the integration, and then remove the old token.

Delete tokens immediately when an integration is retired or a token may have been exposed. The token inherits the effective access of its Atria identity, so use a dedicated least-privileged account where possible.

Troubleshoot authentication

If a request is rejected:

1. Confirm the URL begins with https:// and includes /api before the versioned route.
2. Confirm the header contains Bearer, one space, and the token with no quotes or line breaks.
3. Check that the token has not expired or been deleted.
4. Check that the associated Atria account can access the requested customer and operation.
5. Test a read-only endpoint such as /api/v2/me before retrying a write operation.