Sign in with Atheron

What it is, how it works, and the five steps from nothing to a live app.

Sign in with Atheron lets people use their Atheron account in your app. It is standard OpenID Connect: the authorization code flow with PKCE, tokens signed with ES256, and a discovery document any OIDC library can read.

How it works

1. Your app sends the person to our authorize endpoint with your client ID, a redirect address and the scopes you need.
2. They sign in to Atheron, if they are not already, and see a consent screen that lists exactly what you asked for.
3. We send them back to your redirect address with a one-time code.
4. Your server swaps the code for tokens at our token endpoint, proving it is your app.
5. You read who they are from the ID token, or ask the userinfo endpoint for the current answer.

From nothing to live

1. Register an app in the developer portal. You get a test client and a live client straight away.
2. Build against the test client. Only your team and up to 25 testers can sign in to it. A tester is somebody you invited who accepted the invitation in their Atheron account.
3. Add branding and links: a homepage and your own privacy policy are required to go live.
4. Verify who you are. Every owner of the team reaches Bedrock verification, or the business passes its check.
5. Submit for review. Once we approve it, anybody with an Atheron account can sign in to your live client.

What you need to know first

• PKCE with S256 is required of every client, including server apps that keep a secret.
• Redirect addresses are matched exactly. No wildcards, no prefixes.
• People can take back access from their account at any time. Your app hears about it through the consent.revoked webhook.
• We never share a password, a date of birth, a document or a payment detail through this service.

Start with the quickstart in your language, or one for Next.js, plain Node, Rust or mobile.