# Atheron for developers > Sign in with Atheron is standard OpenID Connect (authorization code with PKCE S256, ES256 tokens) at https://accounts.aton-network.org. The developer portal at https://developers.aton-network.org registers apps, holds their credentials, testers, API keys and webhooks, and hosts these docs, a sandbox and an MCP server. Facts to rely on: PKCE with S256 is required of every client; redirect addresses match exactly; codes last 60 seconds and work once; access tokens 15 minutes; ID tokens 5 minutes; refresh tokens 90 days and rotate on every use; key your records on sub, never email. Every page and the OpenAPI description are below. The full text of every page is at https://developers.aton-network.org/llms-full.txt. ## Start - [Sign in with Atheron](https://developers.aton-network.org/docs): What it is, how it works, and the five steps from nothing to a live app. - [Changelog](https://developers.aton-network.org/docs/changelog): What changed, newest first. ## Quickstarts - [Quickstart](https://developers.aton-network.org/docs/quickstart): Sign in with Atheron in your language: settings, the sign-in link, the code swap and who signed in. Pick a language once and every block follows. - [Quickstart: Next.js](https://developers.aton-network.org/docs/quickstart/nextjs): Add Sign in with Atheron to a Next.js app with route handlers and an HTTP-only session cookie. - [Quickstart: plain Node](https://developers.aton-network.org/docs/quickstart/node): The whole flow with nothing but fetch and node:crypto, so you can see every step. - [Quickstart: Rust](https://developers.aton-network.org/docs/quickstart/rust): Sign in with Atheron from a Rust server using the openidconnect crate. - [Quickstart: mobile and desktop (PKCE)](https://developers.aton-network.org/docs/quickstart/mobile): Public clients: no secret, PKCE only, the system browser and an app scheme or claimed https link. ## Guides and tutorials - [Tutorial: sign-in from start to finish](https://developers.aton-network.org/docs/guides/sign-in): Register an app, send somebody to sign in, handle the callback, check the ID token, keep a session and sign out. - [Tutorial: webhooks](https://developers.aton-network.org/docs/guides/webhooks): Add a webhook, check its signature, handle each event once, and test it before you go live. - [Going to production](https://developers.aton-network.org/docs/guides/production): The checklist before you submit your app for review, and what changes once it is live. - [The verified badge](https://developers.aton-network.org/docs/guides/verified-badge): What the verified badge on the consent screen means and how your team earns it. - [Moving from another sign-in provider](https://developers.aton-network.org/docs/guides/migrating): Add Sign in with Atheron beside the provider you use today, link existing accounts safely, and switch over. - [Troubleshooting](https://developers.aton-network.org/docs/guides/troubleshooting): Step by step: sign-in that never comes back, codes that will not swap, userinfo refusing tokens, and webhooks that do not arrive. - [Getting help](https://developers.aton-network.org/docs/support): Ask the docs, chat with us, check the status page, or report a vulnerability. ## SDKs - [SDKs and libraries](https://developers.aton-network.org/docs/sdks): Every Atheron SDK and framework integration, what is out and what is coming. - [JavaScript and TypeScript SDK](https://developers.aton-network.org/docs/sdks/javascript): Install and use @aton-network/sdk. - [Node and the browser (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/node): Sign in with Atheron in Node and the browser. - [Next.js (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/nextjs): Sign in with Atheron in Next.js. - [React (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/react): Sign in with Atheron in React. - [Vue and Nuxt (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/vue): Sign in with Atheron in Vue and Nuxt. - [SvelteKit (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/sveltekit): Sign in with Atheron in SvelteKit. - [Angular (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/angular): Sign in with Atheron in Angular. - [Express (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/express): Sign in with Atheron in Express. - [NestJS (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/nestjs): Sign in with Atheron in NestJS. - [React Router and Remix (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/react-router): Sign in with Atheron in React Router and Remix. - [Auth.js provider (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/authjs): Sign in with Atheron in Auth.js provider. - [Passport strategy (JavaScript and TypeScript)](https://developers.aton-network.org/docs/sdks/javascript/passport): Sign in with Atheron in Passport strategy. - [Python SDK](https://developers.aton-network.org/docs/sdks/python): Install and use aton-network. - [Django (Python)](https://developers.aton-network.org/docs/sdks/python/django): Sign in with Atheron in Django. - [Flask (Python)](https://developers.aton-network.org/docs/sdks/python/flask): Sign in with Atheron in Flask. - [FastAPI (Python)](https://developers.aton-network.org/docs/sdks/python/fastapi): Sign in with Atheron in FastAPI. - [django-allauth (Python)](https://developers.aton-network.org/docs/sdks/python/allauth): Sign in with Atheron in django-allauth. - [Rust SDK](https://developers.aton-network.org/docs/sdks/rust): Install and use aton-network. - [Axum (Rust)](https://developers.aton-network.org/docs/sdks/rust/axum): Sign in with Atheron in Axum. - [Actix Web (Rust)](https://developers.aton-network.org/docs/sdks/rust/actix): Sign in with Atheron in Actix Web. - [Go SDK](https://developers.aton-network.org/docs/sdks/go): Install and use github.com/Atheron-ATON-Network/atheron-sdk-go. - [net/http (Go)](https://developers.aton-network.org/docs/sdks/go/net-http): Sign in with Atheron in net/http. - [Gin (Go)](https://developers.aton-network.org/docs/sdks/go/gin): Sign in with Atheron in Gin. - [Echo (Go)](https://developers.aton-network.org/docs/sdks/go/echo): Sign in with Atheron in Echo. - [Java and Kotlin SDK](https://developers.aton-network.org/docs/sdks/java): Install and use org.aton-network:aton-network-sdk. - [Spring Boot (Java and Kotlin)](https://developers.aton-network.org/docs/sdks/java/spring-boot): Sign in with Atheron in Spring Boot. - [Spring Security (Java and Kotlin)](https://developers.aton-network.org/docs/sdks/java/spring-security): Sign in with Atheron in Spring Security. - [Kotlin (Java and Kotlin)](https://developers.aton-network.org/docs/sdks/java/kotlin): Sign in with Atheron in Kotlin. - [C# and .NET SDK](https://developers.aton-network.org/docs/sdks/dotnet): Install and use AtonNetwork.Sdk. - [ASP.NET Core (C# and .NET)](https://developers.aton-network.org/docs/sdks/dotnet/aspnet-core): Sign in with Atheron in ASP.NET Core. - [PHP SDK](https://developers.aton-network.org/docs/sdks/php): Install and use aton-network/sdk. - [Laravel Socialite (PHP)](https://developers.aton-network.org/docs/sdks/php/laravel): Sign in with Atheron in Laravel Socialite. - [Symfony (PHP)](https://developers.aton-network.org/docs/sdks/php/symfony): Sign in with Atheron in Symfony. - [WordPress plugin (PHP)](https://developers.aton-network.org/docs/sdks/php/wordpress): Sign in with Atheron in WordPress plugin. - [Ruby SDK](https://developers.aton-network.org/docs/sdks/ruby): Install and use aton-network. - [Rails (Ruby)](https://developers.aton-network.org/docs/sdks/ruby/rails): Sign in with Atheron in Rails. - [OmniAuth strategy (Ruby)](https://developers.aton-network.org/docs/sdks/ruby/omniauth): Sign in with Atheron in OmniAuth strategy. - [Elixir SDK](https://developers.aton-network.org/docs/sdks/elixir): Install and use aton_network. - [Phoenix (Elixir)](https://developers.aton-network.org/docs/sdks/elixir/phoenix): Sign in with Atheron in Phoenix. - [The atheron CLI](https://developers.aton-network.org/docs/sdks/cli): Sign in, list apps, rotate secrets and forward webhooks to localhost from your terminal. ## API reference - [Scopes and claims](https://developers.aton-network.org/docs/scopes): Every scope, what the person is told, what you receive, and which need review. - [Tokens and lifetimes](https://developers.aton-network.org/docs/tokens): What each token is for, how long it lasts and how refresh tokens rotate. - [Secrets and certificates](https://developers.aton-network.org/docs/credentials): Client secrets shown once, rotation without downtime, and certificate credentials with private_key_jwt. - [Verifying your domain](https://developers.aton-network.org/docs/domains): Prove your team owns a domain by a DNS TXT record, a file or a meta tag. Redirects, production and the consent screen depend on it. - [API reference](https://developers.aton-network.org/docs/reference): Every endpoint of Sign in with Atheron, the developer API and the MCP server. - [Discovery document](https://developers.aton-network.org/docs/reference/discovery): Where every other endpoint is, and what the provider supports: scopes, claims, grants, algorithms and client authentication methods. - [Signing keys (JWKS)](https://developers.aton-network.org/docs/reference/jwks): The public keys that sign ID tokens and access tokens, as a JSON Web Key Set. - [Authorize](https://developers.aton-network.org/docs/reference/authorize): The page you send somebody to. They sign in, see what you ask for, and come back to your redirect address with a one-time code. - [Token: swap a code](https://developers.aton-network.org/docs/reference/token): Swaps the code from the redirect for an ID token, an access token and, with offline_access, a refresh token. - [Token: refresh](https://developers.aton-network.org/docs/reference/refresh): Swaps a refresh token for a new access token and a new refresh token. The old refresh token stops working. - [Userinfo](https://developers.aton-network.org/docs/reference/userinfo): Who the person is as of now: the claims their consent allows, read fresh from their account. - [Revoke](https://developers.aton-network.org/docs/reference/revoke): Ends a refresh token and every token in its line. - [Developer API: your app](https://developers.aton-network.org/docs/reference/api-app): The application and environment your API key belongs to: its client ID, redirect addresses, scopes, approved scopes and counts. - [Developer API: usage](https://developers.aton-network.org/docs/reference/api-usage): Calls, errors and latency per day and bucket for your key's environment. - [Developer API: events stream](https://developers.aton-network.org/docs/reference/api-events): Your app's events as Server-Sent Events, the same events and the same bodies as its webhooks, in order, resumable for 30 days. - [MCP server](https://developers.aton-network.org/docs/reference/mcp): The Model Context Protocol server your AI tools connect to: the docs, the reference, examples by language, error lookup, the changelog, status, and, with a key, your app's settings, usage and sandbox calls. - [GraphQL](https://developers.aton-network.org/docs/reference/graphql): The same API as GraphQL: operations, the schema, limits, errors and persisted queries. - [Events stream](https://developers.aton-network.org/docs/reference/events): Every webhook event as it happens, over Server-Sent Events, a WebSocket or a GraphQL subscription. - [Errors](https://developers.aton-network.org/docs/errors): Every error code we return, where, what causes it and how to fix it. - [Webhooks](https://developers.aton-network.org/docs/webhooks): The events we send, their payloads, how they are signed and how retries work. - [Event: user.signed_in](https://developers.aton-network.org/docs/webhooks/user.signed_in): Somebody signed in to your app: a code was issued to your client. - [Event: consent.revoked](https://developers.aton-network.org/docs/webhooks/consent.revoked): Somebody took back your access, from their account or any other way, or we suspended your app. - [Event: membership.changed](https://developers.aton-network.org/docs/webhooks/membership.changed): The plan of somebody who granted you the membership scope changed. - [Event: ping](https://developers.aton-network.org/docs/webhooks/ping): You pressed Send a test on the app's Webhooks page. ## undefined - [ATON Kestrel API](https://developers.aton-network.org/docs/kestrel): Signals with explanations, the sentiment view, the Kestrel Eye, backtests and paper trading from our own AI model family, by the seat. - [Kestrel API quickstart](https://developers.aton-network.org/docs/kestrel/quickstart): Your first signal in three requests. - [Seats, prices and discounts](https://developers.aton-network.org/docs/kestrel/pricing): Builder, Pro, Studio and Enterprise; paper-mode prices; plan discounts; overage. - [Versions and weights](https://developers.aton-network.org/docs/kestrel/versions): Pin a version; each call counts with its version's weight. - [Kestrel API reference](https://developers.aton-network.org/docs/kestrel/reference): Every endpoint, what it costs and the lowest seat that may call it. - [Kestrel API errors and limits](https://developers.aton-network.org/docs/kestrel/errors): Every error code, what caused it and what to do; rate limits by seat. - [Kestrel API in the SDKs](https://developers.aton-network.org/docs/kestrel/sdks): The Kestrel API in every Atheron SDK, generated from the same OpenAPI document. - [Kestrel API changelog](https://developers.aton-network.org/docs/kestrel/changelog): What changed in the Kestrel API, newest first. ## Operating your app - [Rate limits](https://developers.aton-network.org/docs/rate-limits): Requests a minute and a day by quota tier, and what happens when you go over. - [Developer API](https://developers.aton-network.org/docs/api): Read your app's settings and usage with an API key. - [Review and going live](https://developers.aton-network.org/docs/review): What we check, what you need before you submit, and what happens after. - [Button and branding rules](https://developers.aton-network.org/docs/branding): The Sign in with Atheron button kit, how the button must look, and what you may not do with our name. - [Reporting a vulnerability](https://developers.aton-network.org/docs/security): How to tell us about a security problem in Sign in with Atheron or any Atheron service, and what we promise in return. ## Tools - [Sandbox](https://developers.aton-network.org/docs/sandbox): Try the flow against your test client from the browser before writing code. - [MCP server](https://developers.aton-network.org/docs/mcp): Connect your AI coding tools to search these docs, generate integration code, check your setup and run sandbox calls. ## Machine-readable - [OpenAPI 3.1 description](https://developers.aton-network.org/openapi.json): every endpoint, error and webhook event. - [GraphQL](https://developers.aton-network.org/api/graphql): the same API as GraphQL; schema at https://developers.aton-network.org/graphql/schema.graphql, playground at https://developers.aton-network.org/graphql. - [AsyncAPI 3.0 description](https://developers.aton-network.org/asyncapi.json): the events stream (Server-Sent Events, WebSocket, GraphQL subscription) and the webhooks. - [Postman and Bruno collection](https://developers.aton-network.org/collections/atheron.postman_collection.json) - [MCP server](https://developers.aton-network.org/mcp): the docs, the reference, examples by language and your app's data, as tools (Streamable HTTP). - [Discovery document](https://accounts.aton-network.org/.well-known/openid-configuration)