Secrets and certificates
Client secrets shown once, rotation without downtime, and certificate credentials with private_key_jwt.
Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.
A server app proves itself at the token endpoint with a secret or a certificate. Each environment holds up to ten live credentials, each with an expiry of 30 days to two years.
Secrets
A secret starts ath_cs_, so secret scanners can find one pushed by mistake. We show it once and keep only a fingerprint and its last four characters.
Rotating without downtime: make a new secret, deploy it, check the old one's "last used" stops moving, then revoke the old one.
Certificates (private_key_jwt)
Upload the public half of a key pair: an X.509 certificate, a PEM public key or a JWK. EC P-256 (ES256) or RSA of 2048 bits or more (RS256). Never upload the private key; the portal refuses one.
At the token endpoint, instead of a secret, send:
The JWT is signed with your private key and carries:
| Claim | Value |
|---|---|
| iss, sub | your client ID |
| aud | https://accounts.aton-network.org/oauth/token |
| exp | at most ten minutes ahead |
| jti | unique; each one works once |
| kid (header) | the thumbprint the portal shows, optional |
Send an assertion or a secret, never both.
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion=<JWT>Pregunte a Atlas
Asistente de IAPregunte lo que quiera sobre Iniciar sesión con Atheron, la API o el portal. La respuesta sale de nuestra documentación, con enlaces a las páginas usadas.