ATLAS uses OAuth 2.0 client credentials for machine-to-machine access. Create a client in the ORBIS Cloud console under Settings → API Clients. You will be shown the client secret once.
Store the secret in your own secret manager. Do not commit it, do not put it in a front-end bundle, and do not share one client across multiple applications — the audit log and the rate limit are both per-client.
Tokens are valid for 3,600 seconds. The SDKs handle refresh automatically. If you are implementing directly, respect the expires_in field rather than assuming an hour.
For interactive user access, use OIDC via identity.terravek.com instead. Client credentials are for services, not for people.