Settings

Settings

The group is always visible, whatever the RBAC, because the License screen lives inside it and must survive a frozen control plane. The /workspace/config route redirects to client settings; without the Settings permission it renders the no-permission view.

Client Settings (/workspace/config/client-settings)

Includes the global header filter with an allowlist and a denylist.

• Security headers are always blocked regardless of configuration: authorization, proxy-authorization, cookie, host, content-length, connection, transfer-encoding, x-api-key, x-goog-api-key, x-atlasberg-api-key, x-atlasberg-vk.

Compatibility (/workspace/config/compatibility)

• Fields: convert_text_to_chat, convert_chat_to_responses, should_drop_params, should_convert_params.

Caching (/workspace/config/caching)

• Fields: cache mode, configured providers, embedding model and dimension (semantic cache), TTL, similarity threshold, vector namespace, default cache key, conversation history threshold.
• Toggles: exclude system prompt, cache per model, cache per provider, per-request override.

Security (/workspace/config/security)

• Fields: admin username and password, and the setup token. The same three values can be overridden with ATLASBERG_ADMIN_USERNAME, ATLASBERG_ADMIN_PASSWORD and ATLASBERG_SETUP_TOKEN.
• This pair is the break-glass account of the console. Named administrators do not come from this screen: they are local_login accounts in sso.json that carry the console group (local_login.console_group, default atlasberg-console), created on the Identity and SSO screen (Local login tab) or with the atlasberg-console-user tool. Their actions reach the audit trail as local:<username>; the break-glass pair stays the generic administration session subject.
• The setup token error dialog has a View documentation button that opens this page.

Identity and SSO (/workspace/config/identidade)

Who signs in to the portal and the console, through which door, and what a terminal needs to talk to the gateway on a person's behalf. Four tabs over a single file, sso.json: each tab saves its section with a PUT on /api/atlasberg/identidade/config and the gateway applies it live, without a restart and without dropping open sessions. The screen shows the path of the configuration file and an on, off or unavailable state for SSO, local login and devices.

• No secret passes through this screen. The client secret is given as the name of an appliance environment variable; the read shows the name and whether the variable is set, never the value. A file that still stores the secret in the clear gets a warning asking to move it to a variable.
• The one exception is the password of a local account, which is PBKDF2-hashed before it touches the disk and never shown.
• Save and apply writes the file and applies it live; open sessions stay valid. A configuration that does not validate never reaches the disk.
• Every save writes a config.change event with resource sso and the section in the details.
• Fields: single sign-on enabled, issuer (discovery runs at /.well-known/openid-configuration; works for Entra ID, Keycloak and AD FS), client ID, environment variable holding the client secret, redirect URL (with a suggested value for this gateway), post-logout redirect URL, scopes, groups claim, name claim, corporate CA certificate path, secure cookie, session lifetime in minutes, and querying the directory when the token omits groups (Entra overage) with its base URL.
• Test connection runs the OIDC discovery (POST /api/atlasberg/identidade/config/testar) and lists the advertised endpoints.
• Rules mapping a directory group id to a gateway team, with priority. The team sets the virtual key, budget and policies the person gets on sign-in. A team whose SourceID is the group GUID maps by itself, with no rule.
• Default team for people with no mapped group. Blank means the person authenticates but inference is refused until an administrator binds a team.
• Directory synchronization block: directory groups become teams on their own (created, renamed, archived and reactivated as the directory changes), with the key and budgets of a template team, placed under organizational units. Fields: enabled, provider (Entra ID or Keycloak, or detect from the issuer), client ID and secret variable of a read-only application, optional token endpoint, Graph base URL for sovereign clouds, group name prefix or explicit group ids, organizational unit source (none, members' department, members' company, parent group chain), interval in minutes (default 60, minimum 5), template team, revoke personal tokens of people disabled in the directory, and just-in-time team creation at first login.
• Actions: Preview (POST /api/atlasberg/identidade/diretorio/previa) shows the plan; Synchronize now (POST .../diretorio/sincronizar) applies it. Archiving renames the team with the [arquivado] marker and deactivates its keys; nothing is ever deleted. Each cycle writes a config.change event with resource diretorio and actor sincronizacao_diretorio.
• Username and password accounts kept on this appliance. They are the way in when there is no provider (closed network) and the source of named console administrators.
• Fields: local login enabled, the group that grants console access, and the account list with username, name, console access and password source (hash in the file, or an environment variable).
• Actions: create account (password of at least 12 characters), change password, remove account, via the /api/atlasberg/identidade/contas-locais routes.
• Device login: a terminal, IDE or CLI asks for a code; the person confirms it in the portal, already signed in; the terminal receives a personal token bound to the person and their team, which expires on its own and can be revoked here or by the person. The team key never leaves the gateway.
• Fields: device login enabled, token lifetime in hours (default 168, between 1 and 2160), code lifetime in minutes, terminal polling interval in seconds, active tokens per person (over the ceiling, the oldest token is revoked), and the URL the terminal shows.
• Issued personal tokens table: person, device, origin, state (active, expired, revoked), authorized at, last used, expires. Actions: revoke one token, revoke all of a person's tokens (routes /api/atlasberg/identidade/tokens). A counter shows how many codes are awaiting approval right now.
• Warning when ATLASBERG_PROXIES_CONFIAVEIS is empty: behind a load balancer every user shows the proxy's IP, so per-origin limits and the approval screen show that address.
• How a developer connects a terminal, as printed on the screen: atlasberg login -gateway <url>; open the link, sign in to the portal and confirm the code; then eval "$(atlasberg env)" in the shell.

Tab: Provider (OIDC)

Tab: Groups and teams

Tab: Local login

Tab: Devices

Tutorial: configure single sign-on and device login

For administrators. The four tabs of this screen, step by step: OIDC provider, groups to teams, local accounts, device policy and directory sync. About 30 minutes.

Tutorial: sign in from the terminal with SSO

For developers. What the person sees on the other side: one command, one code confirmed in the portal.

Proxy (/workspace/config/proxy)

Only enters the menu in enterprise builds; in a non-enterprise build the page redirects to client settings.

• Fields: enable proxy, proxy type, URL, username and password, exception hosts, connection timeout, optional CA certificate, skip TLS, and SCIM and API toggles.

Performance Tuning (/workspace/config/performance-tuning)

• Fields: initial_pool_size (default 1000) and max_request_body_size_mb (default 100), with a restart-needed indication.

Feature flags (/workspace/config/feature-flags)

Lists the server's feature flags and toggles each one.

License (/workspace/licenca)

The last item of the group. Its access is fixed to true, on the item and on the group, because importing the license is how a frozen appliance thaws. States, KPIs, the activation request and the signed import are documented on the License page.

About Atlasberg Platform

Atlasberg Platform is the control layer between a company and every AI model: each request is authenticated with a virtual key, filtered by policy and DLP, routed to the right provider and written to a hash-chained audit trail. It exposes an OpenAI-compatible API, so applications only swap the base URL.

The same artifact runs in Atlasberg Cloud, in your VPC, on-premises or fully air-gapped, and is priced by capacity and modules, never per seat.

This page is part of the official documentation. To talk to the engineering team, write to [email protected] or use https://atlasberg.com/contato. Answers come within one business day.