For: developers and product.

How the customer signs in

Atlas owns identity. Your app never passes a user identifier and never holds a key.

Email and code

01 The customer enters the email they ordered with.

02 Atlas sends a six-digit code. It is valid for ten minutes and can be used once.

03 The customer enters the code. The session lasts thirty days.

If the email belongs to no order, the surface shows the same message and sends nothing. This is deliberate: the surface is not an oracle for which emails have orders.

Why a code, not a link

A sign-in link opens the mail client's browser, not your app's web view, and is consumed by mail scanners. A code works everywhere.

Activation code Planned

For kits not ordered under the customer's own email — a gift, a clinic order — the customer enters the activation code from the insert, then their email. The code binds that one order to the email. It grants access to that order only.