Code in

WordPress plugin (PHP)

Coming soon. aton-network/sdk is not published on Packagist yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

Atheron Sign In puts a "Sign in with Atheron" button on your WordPress login page. It carries its own copy of the SDK, so there is nothing to install with Composer.

Install

Install the plugin from the WordPress plugin directory (search for Atheron Sign In) and activate it. Settings > Atheron shows the two addresses to register for your app: the redirect address, https://your.site/wp-login.php?action=atheron_callback, and the webhook address, https://your.site/wp-json/atheron/v1/webhook.

Set it up

Constants in wp-config.php win over the settings page and keep the secrets out of the database. On the settings page you choose whether somebody new gets a WordPress account, and whether an existing account with the same verified email is linked.

This example is not written in cURL yet. Showing Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

Protect a page

atheron_sign_in_url() sends somebody to sign in and back to a page on your site. The shortcode [atheron_sign_in] puts the button on any page.

This example is not written in cURL yet. Showing Next.js.

// proxy.ts (middleware.ts before Next 16): anybody not signed in goes to Atheron first, then back.
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron({ protect: ["/account", "/settings"] });

export async function proxy(request: Request): Promise<Response | undefined> {
  return atheron.proxy(request);
}

// In a server component, read the person with: await atheron.user(await cookies())

Webhooks

The plugin checks the signature, then hands the event to the atheron_webhook_event action. atheron_user_by_sub() finds the WordPress user an event is about.

This example is not written in cURL yet. Showing TypeScript.

// Check that a webhook came from Atheron before you act on it. Pass the raw body, exactly as received.
import { verifyWebhook, type WebhookEvent } from "@aton-network/sdk";

export async function handleWebhook(request: Request): Promise<Response> {
  const raw = await request.text();
  const ok = await verifyWebhook(request.headers.get("atheron-signature"), raw, process.env.ATHERON_WEBHOOK_SECRET!);
  if (!ok) return new Response("bad signature", { status: 400 });
  const event = JSON.parse(raw) as WebhookEvent;
  if (event.type === "consent.revoked") {
    // Delete the refresh token you hold for event.data.sub, and stop using what you read.
  }
  return new Response(null, { status: 204 });
}

How it keeps you safe

PKCE (S256), state and nonce on every sign-in. WordPress has no session, so the flow waits in a transient for ten minutes, keyed by a random value in an HTTP-only cookie on the browser that started it, and is spent on use.
People are linked by the ID your site was given for them (user meta atheron_sub), never by email alone unless you turn that on, and an address already on the site never gets a second account.
The plugin keeps no tokens: it signs people in and keeps only the ID your site was given for them.
A return address is always a page on your own site.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.