Secrets and certificates
Client secrets shown once, rotation without downtime, and certificate credentials with private_key_jwt.
مثالوں میں اپنی ٹیسٹ کلائنٹ آئی ڈی دیکھنے کے لیے سائن اِن کریں۔
A server app proves itself at the token endpoint with a secret or a certificate. Each environment holds up to ten live credentials, each with an expiry of 30 days to two years.
Secrets
A secret starts ath_cs_, so secret scanners can find one pushed by mistake. We show it once and keep only a fingerprint and its last four characters.
Rotating without downtime: make a new secret, deploy it, check the old one's "last used" stops moving, then revoke the old one.
Certificates (private_key_jwt)
Upload the public half of a key pair: an X.509 certificate, a PEM public key or a JWK. EC P-256 (ES256) or RSA of 2048 bits or more (RS256). Never upload the private key; the portal refuses one.
At the token endpoint, instead of a secret, send:
The JWT is signed with your private key and carries:
| Claim | Value |
|---|---|
| iss, sub | your client ID |
| aud | https://accounts.aton-network.org/oauth/token |
| exp | at most ten minutes ahead |
| jti | unique; each one works once |
| kid (header) | the thumbprint the portal shows, optional |
Send an assertion or a secret, never both.
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion=<JWT>Atlas سے پوچھیں
AI اسسٹنٹAtheron کے ساتھ سائن ان، API یا پورٹل کے بارے میں کچھ بھی پوچھیں۔ جواب ہماری دستاویزات سے آتا ہے، استعمال شدہ صفحات کے لنک کے ساتھ۔