Authentication

Every request to /v1 and /mcp carries the key in a header:

Authorization: Bearer atl_live_7Kq2mZ9xR4aB_…

Header only. A key in the URL (?api_key=, ?token=, ?access_token=) is refused with 400 credentials_in_url; if that happened, rotate the key.
Format. atl_ + environment (live) + public id + secret + check digits. Atendlly stores only a keyed digest (HMAC) of the secret: the full key is shown once, when created or rotated.
Kinds. Service key: acts as the integration ("Integration «Omie ERP»"). Personal key: acts as the administrator who created it and never does more than that person's current role allows.
Expiry. 30, 90, 180 or 365 days (default 90 for personal keys, 365 for service keys). "No expiry" only for service keys. Administrators get an e-mail 7 days and 1 day before.
Rotate. A new secret for the same key; the previous one keeps working for the period you choose (now, 1 hour, 24 hours or 7 days).
Revoke. Immediate: the next request gets 401 api_key_revoked.
IP restriction. Optional, up to 20 addresses or CIDR ranges (IPv4 and IPv6). Outside the list: 403 ip_not_allowed.

Authentication answers

Situation	Status	`code`
No header, malformed, unknown or wrong key	401	`invalid_api_key`
Expired / revoked key	401	`api_key_expired` / `api_key_revoked`
IP outside the list	403	`ip_not_allowed`
Plan without the API (Básico)	403	`plan_required`
Suspended account	403	`account_suspended`
Owner of a personal key without access to the account	403	`forbidden`

After 20 invalid keys in a minute, the IP address is blocked for 10 minutes.

Custom domains

/v1 and /mcp also answer on your account's own (white-label) domain, for that account's keys only. The docs live on the platform address (https://atende.suporteja.com.br/developers).