Settings: API and webhooks
Two directions. Tokens let your tools call Atlas. Webhooks let Atlas call your tools.
Open it now:Settings, API and webhooks
Tokens: your tools call Atlas
The top of the page is for stores, bots and scripts. Pick the job (Stores and the API explains each) and copy the address it fills in. Below it, the list of tokens is the part you manage.
Each token shows its name, the last four characters, its scopes, how many calls it made in the last 24 hours and when it was last used and from where.
Create a token
| Setting | Meaning |
|---|---|
| Name | For you only, such as sellauth-delivery or chargeback-webhook. |
| Storefront auto-delivery | Turns the token into a delivery address and sets the preset for each key: mask, validity, level, note. Only the owner can create tokens. |
| Scopes | Which actions the token may do: read, generate, ban, reset, pause, extend or delete licenses; read, kick or message sessions. Tick only what the tool needs; you can grant more later. |
| Rate limit | Calls per minute and per hour. A new token starts at 60 and 3,600. |
| IP allowlist | Comma-separated addresses that may use it. Empty accepts any address. |
Look after a token
| Action | Does |
|---|---|
| Edit | Changes the name, scopes, delivery preset, limits and allowlist. |
| Rotate | Makes a new secret and revokes the old one. Use it when an address leaked; every tool using the old one must be updated. |
| Revoke | Stops it working at once. Its history stays. |
| Delete | Removes the token. The record of what it did stays in Application logs. |
| Activity | The last 200 calls the token made, filterable. |
Webhooks: Atlas calls your tools
The second card sends the application's events somewhere else: a Discord channel or your own server. Each webhook has a name, an address, an event filter (empty means every event) and an on/off switch. Discord hooks post a message per event; JSON hooks post a signed request to a public https address, retry on failure and keep a delivery log. The signing secret is shown once, when it is created or rotated.
The events, the signature to verify and the retry schedule are in Webhooks. Post to Discord in an alert rule sends through these webhooks too.