Code en

Quickstart: plain Node

The whole flow with nothing but fetch and node:crypto, so you can see every step.

Connectez-vous pour voir votre propre ID client de test dans les exemples.

No library: every request is visible. Use this to understand the flow, or where you cannot add a dependency.

Make the PKCE pair and send the person to us

import { createHash, randomBytes } from "node:crypto";

const verifier = randomBytes(32).toString("base64url");
const challenge = createHash("sha256").update(verifier).digest("base64url");
const state = randomBytes(16).toString("base64url");

const url = new URL("https://accounts.aton-network.org/oauth/authorize");
url.search = new URLSearchParams({
  response_type: "code",
  client_id: process.env.ATHERON_CLIENT_ID,
  redirect_uri: process.env.ATHERON_REDIRECT_URI,
  scope: "openid profile email",
  state,
  code_challenge: challenge,
  code_challenge_method: "S256",
}).toString();
// Keep verifier and state for this browser (an HTTP-only cookie), then redirect to url.

Swap the code for tokens

Check that the state you got back is the one you sent before you swap the code.

const answer = await fetch("https://accounts.aton-network.org/oauth/token", {
  method: "POST",
  headers: {
    "content-type": "application/x-www-form-urlencoded",
    authorization: "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64"),
  },
  body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: redirectUri, code_verifier: verifier }),
});
const tokens = await answer.json(); // { access_token, token_type, expires_in, scope, id_token, refresh_token? }

Verify the ID token

Fetch our keys from https://accounts.aton-network.org/.well-known/jwks.json, find the key whose kid matches the token header, and check the ES256 signature. Then check iss is https://accounts.aton-network.org, aud is your client ID, exp is in the future and nonce matches if you sent one. Any JOSE library does this in one call.

Demandez à Atlas

Assistant IA

Posez n'importe quelle question sur Se connecter avec Atheron, l'API ou le portail. La réponse vient de notre documentation, avec les liens des pages utilisées.