Module auth 

Bearer-token authentication for the HTTP API.

Atlas serves an OpenAI-compatible API; every mainstream client library (openai, litellm, anthropic, opencode, OpenWebUI) sends Authorization: Bearer <key> by default, so bearer tokens are the only auth scheme that preserves drop-in client compatibility. mTLS and signed requests would force every user to re-tool their client, so we don’t ship them. (If an enterprise customer needs mTLS in front of Atlas, the standard answer is a reverse proxy — nginx, Envoy, Caddy — terminating TLS and forwarding to Atlas on localhost.)

Tokens are loaded once at startup. Two sources are supported:

• --auth-tokens-file <PATH>: one token per line, blank lines and # comments ignored. The standard production form. Permissions should be 0600 and a warning is logged if they’re broader.
• --auth-token <TOKEN>: single inline token. Convenient for quick starts but the token leaks via ps//proc/<pid>/cmdline, so the server logs a one-line warning at startup.

Validation uses constant-time byte comparison (no early-exit on first mismatch) so an attacker can’t measure token-prefix-match latency to recover the secret. Comparing against multiple candidate tokens linearly is acceptable here — the candidate set is tiny (operator-curated), constant-time-bounded, and not under attacker control.

Structs

AuthConfig

Loaded bearer-token validator. Constructed once at startup; cloneable across handlers via Arc<AuthConfig>.