Código en

ASP.NET Core (C# and .NET)

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

Coming soon. AtonNetwork.Sdk is not published on NuGet yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

AtonNetwork.AspNetCore signs people in on ASP.NET Core's cookie authentication: AddAtheron() and MapAtheron() give you the routes, RequireAuthorization() works as it always does, and AtheronWebhooks checks deliveries from the raw body. .NET 8 and later.

Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET and ATHERON_REDIRECT_URI (or Atheron:ClientId, Atheron:ClientSecret and Atheron:RedirectUri in appsettings.json), and ATHERON_WEBHOOK_SECRET for webhooks. The routes are /auth/sign-in, /auth/callback, /auth/sign-out (a POST from your own site) and /auth/session. Register https://your.app/auth/callback as the redirect address.

The app

Este ejemplo aún no está escrito en cURL. Se muestra en Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

Protect a page

A request that asks for JSON gets a 401 instead of the trip to sign in. The person is HttpContext.User: sub as the name identifier, then a claim for each userinfo field (name, email, ...), and User.GetAtheronUser() for the whole userinfo answer.

Este ejemplo aún no está escrito en cURL. Se muestra en Next.js.

// proxy.ts (middleware.ts before Next 16): anybody not signed in goes to Atheron first, then back.
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron({ protect: ["/account", "/settings"] });

export async function proxy(request: Request): Promise<Response | undefined> {
  return atheron.proxy(request);
}

// In a server component, read the person with: await atheron.user(await cookies())

Webhooks

Or in one line: app.MapAtheronWebhook("/webhooks/atheron", (e, http) => ...), which answers 400 for a forgery, 500 when your handler throws (so we deliver it again) and 204 otherwise.

PKCE, state and nonce are checked on every sign-in, the flow is sealed with your Data Protection keys, spent on use and lasts ten minutes, a return address is always a path on your site, signing out revokes the refresh token at Atheron, and a sign-out from another site is refused. Across several servers, share the Data Protection keys as ASP.NET Core's own guide describes.

Este ejemplo aún no está escrito en cURL. Se muestra en TypeScript.

// Check that a webhook came from Atheron before you act on it. Pass the raw body, exactly as received.
import { verifyWebhook, type WebhookEvent } from "@aton-network/sdk";

export async function handleWebhook(request: Request): Promise<Response> {
  const raw = await request.text();
  const ok = await verifyWebhook(request.headers.get("atheron-signature"), raw, process.env.ATHERON_WEBHOOK_SECRET!);
  if (!ok) return new Response("bad signature", { status: 400 });
  const event = JSON.parse(raw) as WebhookEvent;
  if (event.type === "consent.revoked") {
    // Delete the refresh token you hold for event.data.sub, and stop using what you read.
  }
  return new Response(null, { status: 204 });
}

Pregunte a Atlas

Asistente de IA

Pregunte lo que quiera sobre Iniciar sesión con Atheron, la API o el portal. La respuesta sale de nuestra documentación, con enlaces a las páginas usadas.