Código en

Spring Security (Java and Kotlin)

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

Coming soon. org.aton-network:aton-network-sdk is not published on Maven Central yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

With Spring Security, sign people in with oauth2Login. The starter registers Atheron as the atheron client (from ATHERON_* or atheron.*, unless you define registrations of your own) and AtheronSecurity.oauth2Login turns on PKCE, so Spring Security checks the state, the ID token's signature against our keys, its issuer, audience, expiry and nonce. Register https://your.app/login/oauth2/code/atheron as the redirect address and put it in ATHERON_REDIRECT_URI.

Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET and ATHERON_REDIRECT_URI on your server (or atheron.client-id, atheron.client-secret and atheron.redirect-uri in application.properties), and ATHERON_WEBHOOK_SECRET (or atheron.webhook-secrets) for webhooks.

The security filter chain

AtheronSecurity.revokeOnSignOut revokes the refresh token at Atheron when somebody signs out. Sign-in starts at /oauth2/authorization/atheron.

Este ejemplo aún no está escrito en cURL. Se muestra en Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

Protect a page

Este ejemplo aún no está escrito en cURL. Se muestra en Next.js.

// proxy.ts (middleware.ts before Next 16): anybody not signed in goes to Atheron first, then back.
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron({ protect: ["/account", "/settings"] });

export async function proxy(request: Request): Promise<Response | undefined> {
  return atheron.proxy(request);
}

// In a server component, read the person with: await atheron.user(await cookies())

Webhooks

Already have registrations for other providers? Add AtheronSecurity.registration(clientId, clientSecret, redirectUri, scopes, null) to your ClientRegistrationRepository.

Este ejemplo aún no está escrito en cURL. Se muestra en TypeScript.

// Check that a webhook came from Atheron before you act on it. Pass the raw body, exactly as received.
import { verifyWebhook, type WebhookEvent } from "@aton-network/sdk";

export async function handleWebhook(request: Request): Promise<Response> {
  const raw = await request.text();
  const ok = await verifyWebhook(request.headers.get("atheron-signature"), raw, process.env.ATHERON_WEBHOOK_SECRET!);
  if (!ok) return new Response("bad signature", { status: 400 });
  const event = JSON.parse(raw) as WebhookEvent;
  if (event.type === "consent.revoked") {
    // Delete the refresh token you hold for event.data.sub, and stop using what you read.
  }
  return new Response(null, { status: 204 });
}

Pregunte a Atlas

Asistente de IA

Pregunte lo que quiera sobre Iniciar sesión con Atheron, la API o el portal. La respuesta sale de nuestra documentación, con enlaces a las páginas usadas.