Step 4 — Credentials
Which credential to hold — and why the one you already have from step 2 is usually enough.
Three credential classes reach Atribu, and picking the wrong one is the most
common way a first integration stalls at a 403.
| credential | who it is | when to use it |
|---|---|---|
atb_user_… MCP / user token | a person | an agent acting on someone's behalf, on MCP and REST |
atb_live_… API key | one profile | a machine job: a nightly export, a CI check, a webhook consumer |
| session | the console | Atribu's own UI |
Open Settings → Developer
The Developer tab lists this profile's API keys — prefixes only, never the secret.
Create an API key
Pick the scopes it needs. Default is the analytics read set; add
goals:write, exports:write or a messaging scope only if the job actually
does that.
Copy it now
It starts with atb_live_ and is shown exactly once. Store it in your
secret manager before leaving the page.
MCP tokens live under the same Developer tab, or are minted for you by the OAuth consent in step 2.
If you completed step 2 through the OAuth hand-off, you are done. Since
#1084 an atb_user_… token is a first-class /api/v1 principal, so the token
you already hold works on both surfaces:
curl -sX POST https://mcp.atribu.app/mcp \
-H "Authorization: Bearer atb_user_…" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"whoami","arguments":{}}}'curl -H "Authorization: Bearer atb_user_…" \
https://api.atribu.app/api/v1/workspacesA credential cannot administer its own class
/api/v1/me/** and the workspace API-key routes are session bearers only.
An API key is one profile — not a person, with no MCP credentials of its own —
so it can never mint, rotate or revoke a key or a token. Minting stays a
signed-in human's act, and an agent that needs a key hands its user a link to
Settings → Developer.
Two more rules that decide what a 403 means:
- Scopes are an intersection of what the human granted on the consent
screen and what their membership already allows.
mcp:readmaps toanalytics:read+campaigns:read; no MCP scope reaches exports, commerce or messaging. insufficient_scopenames the scope it wanted, and carries adocs_url— see Errors.
Rotating and revoking
…/api-keys/{id}/rotate issues a replacement and returns the new secret;
…/revoke kills one outright. Rotation is the right move for a key that may
have leaked: revoking alone leaves whatever used it broken until someone
notices.