# hello-go

Atrium starter sample: Go (hello-go).

Minimal Atrium web app using Go stdlib (`net/http`, `crypto/hmac`).

Default port: **5102** (`PORT` env override).

## Run

```bash
go run .
```

Your process reads `ATRIUM_SETUP_SECRET` to verify the first `lifecycle.setup` call. That is your app's own setup secret: COHO mints it when you register the app and shows it once in the create response (regenerate it from My apps if lost). On Atrium Hosting, COHO injects the env var for you; when self-hosting, set it yourself before connecting. Set `ATRIUM_DATA_DIR` to persist connection secrets and config across restarts. Set `ATRIUM_FRAME_ANCESTORS` and `ATRIUM_PARENT_ORIGIN` to the Store origin for the environment you embed from (same value for both). Playground and production values are in [developer spec §6](../../docs/what-an-atrium-app-is/#self-host-store-origins); when unset, these kits default to `http://localhost:4200` for local `ng serve`.

## Endpoints

Same runtime contract as the other hello samples:

- `/health`
- signed `/webhooks/atrium/*`
- signed native config at `/config/schema` and `/config`
- signed iframe quick view at `/ui`
- external app-owned page at `/configure`

COHO opens `/ui` and `/configure` with a short-lived signed launch URL that includes `connectionReference`, `atriumUsageToken` (person + organisation + connection JWT), and `atriumSignature`. Prefer `Authorization: Bearer <atriumUsageToken>` for interactive Public API calls from the quick view; keep the connection `apiKey` from `lifecycle.setup` for background/webhooks. See [developer spec §6 / §8](../../docs/what-an-atrium-app-is/).

For local Store registration, use [`manifest.example.json`](https://github.com/CompanyForLife/atrium-app-samples/blob/main/samples/hello-go/manifest.example.json).

Signature verification is pinned to the published test vectors in the [app developer spec](../../docs/calls-coho-makes-to-you/#signature-test-vectors).