How it connects — and what is stored
It is a beta
Atlasito is a beta. It creates real projects, issues, pages and automation rules on the site you connect. It is not yet something to trust with a production site — run it on a playground: a free Atlassian Cloud site takes a few minutes to set up, and that is where every result in the demo was made.
Two ways in, and the rule that picks one
Atlasito reaches your site through two credential channels. Which one a call uses is derived from the API method itself, never from a list.
Published APIs — Atlassian OAuth 2.0 (3LO). When you sign in, you grant an Atlasito app (a Forge app, unpublished during the beta) a token for the scopes it needs. Everything Atlassian has published — projects, issues, fields, spaces, pages — goes this way, as long as the token carries the scope that method needs.
A published method the token cannot reach goes the other way. The gateway answers a call whose scope you did not grant with a refusal, and the same call succeeds on your browser session — so when the extension is connected, that method runs there instead. It is the second channel used for a documented API, which is a different thing from calling an undocumented one, and you are told which methods those are at the gate that asks whether to run the steps. Nothing is routed this way silently.
Unpublished APIs — the Atlasito Chrome extension. Much of what makes cross-product setup possible — Automation rules, screens, and other things only the product's own UI can do — is not on the OAuth gateway at all. For those, the extension lends the assistant your own browser session (its cookies and XSRF token) for the duration of a run. The assistant can then do exactly what you could do in the browser, under your identity and your permissions, and nothing more.
This is the part an engineer will call unscalable, and for a product it would be. For a beta it is the bridge that lets one request span Jira, Confluence and Automation today, while the published surface catches up. The catalogue of what Atlasito can call is rebuilt only by measured slices from Atlassian's own API documents, so when a method moves from unpublished to published, the channel moves with it — by rule, not by patch.
Where the credential lives
In neither channel does the model see a credential. Generated code runs in a sandbox behind a credential proxy that holds one credential for its lifetime and refuses any request for the other channel. A plan whose calls would need both channels is refused before anything runs. The token is renewed after each human approval, so waiting on a question cannot expire it. Secrets at rest are under AWS KMS. Redaction happens in the trace recorder, before a line exists.
Nothing is created before you approve it
Every run plans first, shows the plan and the exact code, and waits. Any stage can ask you one question. A destructive step requires a bounded read first. After it runs, it reads the site back to verify, and says unchecked — with the reason — where it could not.
What is stored, and where
Only the run trace and the generated programs, on the AWS deployment, for the account that ran them. Both are kept, and are deleted by hand when you ask: DM Ricardo. Nothing from your site enters the code repository; captured browser traffic never does.
About the Forge app
The Atlasito app is registered in the Atlassian developer console and is unpublished — it is not on the Marketplace and is not meant to be during the beta. Because it is unpublished, each tester's Atlassian account must be added as a test user by hand: that is why an access code is issued by DM, with your email.
When you sign in, Atlassian's consent screen will say this app is 'not yet reviewed by Atlassian'. That is expected: it is a beta app, not a Marketplace listing.
What works today
Only what has run end to end twice is listed here, from the same list that travels with an access code. The list fills as scenarios are confirmed.
How to get a code
DM Ricardo on LinkedIn with the email of your Atlassian account. You get a code, the extension, and a short list of what works today. One code per person; ask for more for a team.