Código en

OmniAuth strategy (Ruby)

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

Coming soon. aton-network is not published on RubyGems yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

omniauth/strategies/atheron is Atheron as an OmniAuth strategy, for Rails (with Devise or on its own), Sinatra or any Rack app. It comes with the atheron gem.

Install

In Rails, add omniauth-rails_csrf_protection too: OmniAuth starts a sign-in only from a POST that carries the page's authenticity token.

bash

bundle add aton-network omniauth

Add the provider

Register https://your.app/auth/atheron/callback as the redirect address. env["omniauth.auth"] then holds uid (the ID your app was given for the person, made for your app alone: key your records on it, never on email), info (name, email, nickname, image), credentials (the tokens) and extra.raw_info (userinfo's claims).

Este ejemplo aún no está escrito en cURL. Se muestra en Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

How it keeps you safe

PKCE (S256), state and nonce on every sign-in. The callback is checked by the same rules as every Atheron SDK: the state first, then the issuer, then an error Atheron sent, then the code. A failure goes to OmniAuth's failure route with its code, such as invalid_state.
An ID token that comes back is held to its issuer, audience, expiry and nonce.
The redirect address sent with the code is the registered one, never with the callback's own query.
An email Atheron has not verified is not handed on: info.email is absent for it.

Pregunte a Atlas

Asistente de IA

Pregunte lo que quiera sobre Iniciar sesión con Atheron, la API o el portal. La respuesta sale de nuestra documentación, con enlaces a las páginas usadas.