Code in

Quickstart: plain Node

The whole flow with nothing but fetch and node:crypto, so you can see every step.

No library: every request is visible. Use this to understand the flow, or where you cannot add a dependency.

Make the PKCE pair and send the person to us

import { createHash, randomBytes } from "node:crypto";

const verifier = randomBytes(32).toString("base64url");
const challenge = createHash("sha256").update(verifier).digest("base64url");
const state = randomBytes(16).toString("base64url");

const url = new URL("https://accounts.aton-network.org/oauth/authorize");
url.search = new URLSearchParams({
  response_type: "code",
  client_id: process.env.ATHERON_CLIENT_ID,
  redirect_uri: process.env.ATHERON_REDIRECT_URI,
  scope: "openid profile email",
  state,
  code_challenge: challenge,
  code_challenge_method: "S256",
}).toString();
// Keep verifier and state for this browser (an HTTP-only cookie), then redirect to url.

Swap the code for tokens

Check that the state you got back is the one you sent before you swap the code.

const answer = await fetch("https://accounts.aton-network.org/oauth/token", {
  method: "POST",
  headers: {
    "content-type": "application/x-www-form-urlencoded",
    authorization: "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64"),
  },
  body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: redirectUri, code_verifier: verifier }),
});
const tokens = await answer.json(); // { access_token, token_type, expires_in, scope, id_token, refresh_token? }

Verify the ID token

Fetch our keys from https://accounts.aton-network.org/.well-known/jwks.json, find the key whose kid matches the token header, and check the ES256 signature. Then check iss is https://accounts.aton-network.org, aud is your client ID, exp is in the future and nonce matches if you sent one. Any JOSE library does this in one call.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.