Skip to content
PalomPalomAtlas

CORS & Authentication

CORS

Section titled “CORS”
Variable Default Description
ATLAS_CORS_ORIGINS empty Comma-separated origins allowed to call the API from a browser. Leave unset if nothing browser-based calls the API directly.

Authentication

Section titled “Authentication”

See Authentication for how these fit together, and Configure SSO with Keycloak for a walkthrough of the OIDC variables below against a real provider.

Variable Default Description
ATLAS_AUTH_JWT_SECRET required Signs the session cookie. Rotating it logs everyone out at once — the only revocation lever this design has.
ATLAS_AUTH_SESSION_TTL_SECONDS 28800 (8h) Session lifetime.
ATLAS_SESSION_COOKIE_SECURE true Set false only for local http:// development — a real deployment must serve over HTTPS.
ATLAS_AUTH_BOOTSTRAP_ADMIN_USERNAME unset Break-glass account username. Leave unset, along with the password below, to disable password login entirely.
ATLAS_AUTH_BOOTSTRAP_ADMIN_PASSWORD unset Break-glass account password.
ATLAS_AUTH_OIDC_DISCOVERY_URL unset Leave unset to disable OIDC entirely — the login button disappears and the callback route 404s.
ATLAS_AUTH_OIDC_CLIENT_ID unset OIDC client id.
ATLAS_AUTH_OIDC_CLIENT_SECRET unset OIDC client secret.
ATLAS_AUTH_OIDC_ID_CLAIM sub Which id_token claim becomes a principal’s id. Changing it once real users exist orphans every principal created under the old claim.
ATLAS_AUTH_OIDC_NAME_CLAIM name Which claim becomes the principal’s display name.
ATLAS_AUTH_OIDC_SCOPE openid profile email Space-separated. Add your provider’s groups scope if authorization rules will key on groups.
ATLAS_AUTH_OIDC_ENABLE_PKCE true PKCE for the authorization code flow.
ATLAS_ALLOW_SELF_REGISTRATION false false: an admin must create a principal before that identity can log in. true: first OIDC login auto-provisions it.
ATLAS_AUTH_FRONTEND_URL http://localhost:3000 Where the browser lands after a successful OIDC callback — the API has no frontend route of its own to send it to.