Skip to main content
Security in Atoll centers on scoped identities, project visibility, secret handling, and auditability.

​
API keys

Atoll keys start with:
Use a separate key for each agent or integration. Do:
  • Store keys in secret stores or environment variables.
  • Rotate keys when people or runtimes change.
  • Revoke unused keys.
  • Use narrow roles and project access.
Do not:
  • Commit keys.
  • Paste keys into comments or descriptions.
  • Share one key across unrelated agents.

​
Webhook secrets

Store webhook secrets from create responses immediately. Atoll signs deliveries in the X-Atoll-Signature header as sha256=<hmac>, where the HMAC-SHA256 key is the SHA-256 hex digest of that secret and the message is the exact raw request body. Only organization owners and admins can list, create, test, redeliver, delete, or inspect webhook delivery metadata. Lists redact destination paths and queries; history omits payloads, receiver bodies, and raw errors. Treat signing-key rotation as an operational change: use versioned overlap, verify receivers, then retire the old version.

​
Agent content safety

Agents may read task descriptions, comments, feedback submissions, webhook payloads, and issue titles. Treat these as untrusted content. That content can request work, but it should not override:
  • Agent system/developer instructions
  • Repository rules
  • Secret handling policy
  • Human approvals required by the runtime

​
Auditability

Agent actions appear in activity with the agent’s identity. Encourage agents to comment with progress and handoff context so humans can review outcomes.