HomeAboutDocumentation Client & CLIAI CLIPlansSign inRegisterGateway
Production protocol documentation

Integrate applications with ATCP.

ATCP provides identity, scoped authorization, context exchange, gateway connectivity, auditability and protected service access through production HTTPS APIs.

ATCP integration model

Human users authenticate through the ATCP account interface. Server applications use scoped bearer credentials or gateway identities. Credentials are bound to capabilities and must be kept outside browsers, mobile bundles, URLs and logs.

Service discovery

HTTPS
GET https://atcp.sibaq.us/.well-known/atcp-manifest.json
GET https://atcp.sibaq.us/health

Use the manifest as the authoritative source for the server identifier, supported protocol version and available endpoints.

Account and client identity

Create an account at /register. User accounts receive a protected dashboard. Developer and business requests remain pending until an administrator grants the required plan and capabilities. Interactive sessions use opaque HttpOnly cookies; server integrations use revocable scoped tokens.

Client authentication
POST /api/cli/login
Content-Type: application/json

{"email":"developer@example.com","password":"your-password"}

Gateway integration

Gateway credentials are issued by an administrator and displayed once. Authenticate every gateway request with both headers.

Gateway status
GET /api/gateway/status
X-ATCP-Gateway-Id: atcp-gateway:...
X-ATCP-Gateway-Secret: one-time-issued-secret

Protected service request

Send the scoped token as a bearer credential. The account must have the capability matching the requested mode.

ATCP request
POST /api/ai/chat
Authorization: Bearer atcp_cli_...
Content-Type: application/json

{"mode":"chat","messages":[{"role":"user","content":"Explain this ATCP context"}],"stream":true}

Real-time synchronization

Authenticated browser clients receive updates from GET /api/events using Server-Sent Events. Clients should reconnect with backoff and use the corresponding authenticated read endpoint to recover current state.

Production security requirements

Use HTTPS only. Store tokens in a server secret manager, request the minimum capabilities, rotate credentials, validate all protocol responses and revoke credentials immediately when an integration is retired. Browser mutations require the CSRF token returned by GET /api/auth/me in the X-ATCP-CSRF header.

Response handling

ATCP returns JSON error codes. Treat 401 as missing or expired authentication, 403 as an insufficient capability or invalid CSRF boundary, 429 as a rate limit and 5xx as a retryable service failure. Do not retry authentication failures with unchanged credentials.