Authentication - Atlas API Documentation

Atlas uses JWT-based authentication. You exchange your Client-Id and Client-Secret for a short-lived access token, then include that token in the Token header on every subsequent API request. Tokens expire after 3600 seconds (one hour); use the refresh token endpoint to obtain a new access token without re-submitting your credentials.

How authentication works

Your accounts team provisions a Client-Id and Client-Secret for your integration.
You call the respective auth API with those credentials in the request headers.
Atlas returns an access_token and a refresh_token.
Include the access token in the Token header for all subsequent requests.
When the access token expires, call the respective auth API to get a new one.

Keep your Client-Secret and tokens secure. Never expose them in client-side code, public repositories, or logs.

Sample generation of an access token

POST /verification/authtoken Pass your credentials as request headers. The response body contains the access token and its expiry time in seconds.

Request headers

Header	Type	Required	Description
`Client-Id`	string	Yes	Your Atlas client ID
`Client-Secret`	string	Yes	Your Atlas client secret

Response

Field	Type	Description
`access_token`	string	JWT token to use in the `Token` header
`expires_in`	integer	Token lifetime in seconds (3600)

curl --request POST \
  --url https://docstream.dev.kreditmind.com/v1/docstream/authtoken \
  --header "Client-Id: your-client-id" \
  --header "Client-Secret: your-client-secret"

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 3600
}

Error responses

Status	Meaning
`400`	`Client-Id` or `Client-Secret` header is missing
`401`	The credentials provided are invalid

{
  "error": "Missing Client-Id or Client-Secret"
}

{
  "error": "Invalid Client-Id or Client-Secret"
}

Using the token

Include the access token in the Token header on every request that requires authentication:

Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

For example, when uploading documents:

curl --request POST \
  --url https://docstream.dev.kreditmind.com/v1/docstream/multiupload \
  --header "Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --header "Content-Type: application/json" \
  --data '{"product_type": "POC_CDL", "file_urls": [], ...}'