Skip to content
AtheronDEVELOPERS
← Ruby SDK

OmniAuth strategy (Ruby)

Sign in with Atheron in OmniAuth strategy.

Sign in to see your own test client ID in the samples.

Coming soon. aton-network is not published on RubyGems yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

omniauth/strategies/atheron is Atheron as an OmniAuth strategy, for Rails (with Devise or on its own), Sinatra or any Rack app. It comes with the atheron gem.

Install

In Rails, add omniauth-rails_csrf_protection too: OmniAuth starts a sign-in only from a POST that carries the page's authenticity token.

bash
bundle add aton-network omniauth

Add the provider

Register https://your.app/auth/atheron/callback as the redirect address. env["omniauth.auth"] then holds uid (the ID your app was given for the person, made for your app alone: key your records on it, never on email), info (name, email, nickname, image), credentials (the tokens) and extra.raw_info (userinfo's claims).

This example is not written in cURL yet. Showing Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

How it keeps you safe

  • PKCE (S256), state and nonce on every sign-in. The callback is checked by the same rules as every Atheron SDK: the state first, then the issuer, then an error Atheron sent, then the code. A failure goes to OmniAuth's failure route with its code, such as invalid_state.
  • An ID token that comes back is held to its issuer, audience, expiry and nonce.
  • The redirect address sent with the code is the registered one, never with the callback's own query.
  • An email Atheron has not verified is not handed on: info.email is absent for it.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.