One SDK for every framework

A stack is rarely one language. There's the frontend a user sees, the services behind it, and often a native mobile app too — and each usually means a different idea of what a session is. Atlas takes the opposite stance: one identity model, and a first-class, typed SDK for wherever you meet it.

Frontend

Eight frontend SDKs, each idiomatic to its framework — hooks and context in React, composables in Vue and Nuxt, stores in Svelte, and framework-native primitives everywhere else:

On the client you only ever hold a publishable key (pk_live_…) — safe to ship in a browser bundle, scoped to exactly the public operations a frontend needs and nothing more:

import { AtlasProvider, SignedIn, SignedOut, SignIn } from '@atlas/react';

export default function Root() {
  return (
    <AtlasProvider publishableKey={process.env.ATLAS_PK!}>
      <SignedIn><Dashboard /></SignedIn>
      <SignedOut><SignIn /></SignedOut>
    </AtlasProvider>
  );
}

Backend

Seven backend SDKs verify the session token your frontend sends and give you the authenticated user, organization and permissions — no session plumbing to write by hand:

Backends use a secret key (sk_live_…) that stays on the server. Here's a request guard in Go:

package main

import "github.com/atlas/atlas-go"

func handler(w http.ResponseWriter, r *http.Request) {
    session, err := atlas.Authenticate(r)
    if err != nil {
        http.Error(w, "unauthorized", http.StatusUnauthorized)
        return
    }
    fmt.Fprintf(w, "hello %s", session.User.ID)
}

Mobile

Three native mobile SDKs bring the same sign-in, sessions and passkey support to the platforms your users carry:

Least-privilege keys, by construction

The split between publishable and secret keys isn't a convention you have to remember — it's built into the SDKs. Client SDKs simply cannot perform privileged operations, and every key is scoped to a single instance. If a browser bundle leaks, what leaks is a key that could only ever do what a logged-out visitor could already do.

One model, everywhere

A user, an organization, a role and a permission mean the same thing in every SDK, so moving from your React app to your Go service to your iOS client is a change of syntax, not of mental model. Pick the SDKs your stack needs — the identity underneath is the same in all of them.