Code in

Laravel Socialite (PHP)

Coming soon. aton-network/sdk is not published on Packagist yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

aton-network/sdk adds an atheron driver to Laravel Socialite. Laravel finds it on its own once the package is installed.

Install

Add the app to config/services.php, with the values in .env:

Register https://your.app/auth/callback as the redirect address, and give your users table a nullable, unique atheron_id column: people are found by the ID your app was given for them (sub, made for your app alone), never by email.

bash

composer require aton-network/sdk laravel/socialite

php

'atheron' => [
    'client_id' => env('ATHERON_CLIENT_ID'),
    'client_secret' => env('ATHERON_CLIENT_SECRET'),
    'redirect' => env('ATHERON_REDIRECT_URI'),
    'webhook_secret' => env('ATHERON_WEBHOOK_SECRET'),
],

Ask for more with Socialite::driver('atheron')->scopes(['membership'])->redirect(). Auth::login() gives the person a new session ID.

This example is not written in cURL yet. Showing Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

Protect a page

This example is not written in cURL yet. Showing Next.js.

// proxy.ts (middleware.ts before Next 16): anybody not signed in goes to Atheron first, then back.
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron({ protect: ["/account", "/settings"] });

export async function proxy(request: Request): Promise<Response | undefined> {
  return atheron.proxy(request);
}

// In a server component, read the person with: await atheron.user(await cookies())

Webhooks

This example is not written in cURL yet. Showing TypeScript.

// Check that a webhook came from Atheron before you act on it. Pass the raw body, exactly as received.
import { verifyWebhook, type WebhookEvent } from "@aton-network/sdk";

export async function handleWebhook(request: Request): Promise<Response> {
  const raw = await request.text();
  const ok = await verifyWebhook(request.headers.get("atheron-signature"), raw, process.env.ATHERON_WEBHOOK_SECRET!);
  if (!ok) return new Response("bad signature", { status: 400 });
  const event = JSON.parse(raw) as WebhookEvent;
  if (event.type === "consent.revoked") {
    // Delete the refresh token you hold for event.data.sub, and stop using what you read.
  }
  return new Response(null, { status: 204 });
}

How it keeps you safe

PKCE (S256), state and nonce on every sign-in. The callback is checked by the same rules as every Atheron SDK: the state first, then the issuer, then an error Atheron sent, then the code. stateless() is refused.
An ID token that comes back is held to its issuer, audience, expiry and nonce.
The secret goes in the Authorization header, never in the form.
An email Atheron has not verified is not handed on as the person's: getEmail() is null for it.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.