Security

Clinical data is one of the highest-value targets for attackers. Every access point is a potential exposure — and regulators expect you to prove it's controlled.

Atomik's security model covers three layers: who can access the system, how they authenticate, and what they're allowed to do. Each layer can be configured to match your organization's existing security infrastructure — from a simple local user setup to enterprise SSO with multi-factor authentication.

Local user management

Atomik includes built-in user management with two access levels:

Administrators — full access to the Web Console for managing templates, queries, audit logs, and system configuration
API users — REST API access only, authenticated via the auth endpoint which returns a JWT token used in subsequent requests

All Atomik access tokens use the JWT format. Tokens expire after 24 hours by default — configurable to match your security policy.

External user management (SSO / Identity Providers)

Managing users separately in every system is how credentials get lost, offboarding gets missed, and audit trails fragment across tools. If your organization already has a central identity provider, Atomik can integrate with it — so user provisioning, roles, and authentication happen in one place.

We recommend Keycloak for teams that need a self-hosted, open-source identity provider. It handles OAuth2/OIDC authentication, role-based access control, single sign-on across multiple applications, and multi-factor authentication — all manageable from a single admin interface. Once integrated, Atomik delegates authentication entirely to Keycloak: your team logs in once and accesses Atomik alongside your other systems without separate credentials.

Application access tokens

Some integrations don't have a human user logging in — a background service, a mobile app, or an integration engine needs API access on behalf of the application itself. For these cases, Atomik administrators can create application-level access tokens that are configured directly in the external system.

The application authenticates with its token; Atomik trusts it and delegates user-level authorization to the calling application. Any token can be revoked instantly from the admin panel — no code change, no deployment required.

REST API authentication

API users authenticate via POST /api/v1/auth with their credentials. On success, Atomik returns a JWT that must be included as a Bearer token in all subsequent requests:

Authorization: Bearer {token}

Tokens expire after 24 hours. Requests with expired tokens receive an error response — the client re-authenticates to get a fresh token.

Web Console authentication

The Web Console uses standard username and password login. Optional hardening available on request:

Google reCAPTCHA on the login form
Two-factor authentication via TOTP mobile app