> ## Documentation Index > Fetch the complete documentation index at: https://docs.westyx.dev/llms.txt > Use this file to discover all available pages before exploring further. # .NET SDK > Official .NET SDK for Westyx Nexus - minimal dependencies, async/await, DI-ready. Official .NET SDK for [Westyx Nexus](https://westyx.dev) - the centralised secrets, feature flags, and config service. ```csharp theme={null} await using var client = await NexusClient.CreateAsync(new NexusConfig { BaseUrl = "https://blue-ocean-a5rx7.westyx.dev", ApiKey = "wxs_...", }); client.ConnectStream(); var (dbUrl, found) = client.GetConfig("database.url"); string stripeKey = await client.GetSecretAsync("stripe.key"); bool newCheckout = client.GetFlag("new.checkout", defaultValue: false); ``` ## What's new in v0.11.0 Acts on an external .NET developer's review. Several items are **breaking**, and every deliberate departure from .NET convention is explained in [Design decisions](/sdks/dotnet/design-decisions). **Five packages instead of two** - a console app no longer drags in the configuration pipeline it never uses: | Package | What it gives you | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `WestyxNexus` | The client: sync, cache, SSE, WIF. No framework integration. | | `WestyxNexus.Extensions.DependencyInjection` | [`AddWestyxNexus()`](/sdks/dotnet/dependency-injection), `IHttpClientFactory` + `ILoggerFactory` wiring, async startup, [`AddWestyxNexusSecrets()`](/sdks/dotnet/secrets-binding) | | `WestyxNexus.Extensions.Configuration` | `AddWestyx()` - configs through [`IConfiguration`](/sdks/dotnet/aspnetcore-configuration) | | `WestyxNexus.FeatureManagement` | [`Microsoft.FeatureManagement` provider](/sdks/dotnet/feature-management) | | `WestyxNexus.OpenFeature` | [OpenFeature provider](/sdks/dotnet/openfeature) (unchanged) | * **BREAKING - `AddWestyx()` moved** to `WestyxNexus.Extensions.Configuration`. Add the package reference; the namespace is unchanged, so no code edit. * **BREAKING - multi-targeted `net8.0;net10.0`.** .NET 8 goes out of support on **2026-11-10**; .NET 10 is the current LTS (to 2028-11-14). * **`NexusConfig.LoggerFactory`** takes a standard `ILoggerFactory`; `INexusLogger` is obsolete but still bridged. Log statements are structured, under the categories `Westyx.Nexus.NexusClient`, `Westyx.Nexus.Stream` and `Westyx.Nexus.Wif`. * **Async startup.** `AddWestyxNexus()` runs the initial sync in an `IHostedService` instead of blocking a thread-pool thread. * **`NexusConfig.PooledConnectionLifetime`** (default 2 minutes). The framework default is infinite, so an application-lifetime singleton never recycled a connection and never observed a DNS change. * **`IConfiguration` binding fixed twice** - dotted keys are now section-navigable (`GetSection("database")` used to come back empty and bind nothing), and JSON objects and arrays are flattened instead of stored as one opaque string. * **[`AddWestyxNexusSecrets()`](/sdks/dotnet/secrets-binding)** binds secrets to `IOptions` with live re-bind, without putting them in `IConfiguration`. * **[`AddWestyxNexusFeatureManagement()`](/sdks/dotnet/feature-management)** serves Nexus flags to `IFeatureManager` from the in-memory cache. **Fixes** * File-type secrets are now written **owner-readable only** (`0600`). They previously used the process umask - typically `0644` on Linux, readable by every local user on the machine. * Two clients holding the same secret no longer share one temp file; the first disposed used to delete it out from under the other. * The post-sync notification is additive - it was a single slot, so using both the configuration provider and the secrets binder silently disabled live reload on one of them. ## What's new in v0.10.0 * Version alignment across the Westyx Nexus SDK suite. ## What's new in v0.9.0 * **`aws_iam` WIF provider (AWS IAM Caller Identity)** - authenticates non-EKS AWS compute (**ECS/Fargate, Lambda, plain EC2**) that has IAM credentials but no OIDC token. The SDK SigV4-signs an STS `GetCallerIdentity` request (never sent to AWS) and posts it to `/v1/auth/token-exchange`; Nexus replays it against a pinned STS endpoint to prove your IAM role. The signed `X-Nexus-Server-ID` is your service's own base-URL host - a captured request is valid for that one service only, and there is nothing to configure. Uses `AWSSDK.Core` for the credential/region chain only. See [Workload identity](/sdks/dotnet/workload-identity#aws-iam-non-eks-aws-compute). * **Azure Workload Identity (AKS)** - the `Azure` provider now prefers the projected federated token file (`$AZURE_FEDERATED_TOKEN_FILE`) before falling back to IMDS; auto-detection probes the file too. * **Probe-based auto-detection** - auto-detect now stats the Kubernetes / AWS-IRSA / Azure token files and live-probes the GCP and Azure metadata servers (\~1 s timeout), instead of keying on environment variables absent on real cloud nodes. * **Security hardening** - `NexusClient.CreateAsync` rejects plain-http `BaseUrl`s (loopback excepted); the Azure IMDS path refuses the generic default audience (must be `api://`); expired WIF sessions fail closed; the metadata client disables redirects and the system proxy; metadata/exchange reads are bounded. ## What's new in v0.8.0 * **`WestyxNexus.OpenFeature` NuGet sub-package** - install `WestyxNexus.OpenFeature` alongside `WestyxNexus` and register `NexusProvider` as an OpenFeature provider. Feature flags resolve via `ResolveBooleanValue`; configs via `ResolveString/Double/Integer/StructureValue`. All reads are cache-backed. See [OpenFeature integration](/sdks/dotnet/openfeature). ## What's new in v0.7.0 * **ASP.NET Core `IConfiguration` integration** - `builder.Configuration.AddWestyx(nexusConfig)` plugs Nexus into the standard configuration pipeline. All config values are accessible via `IConfiguration`, bindable via `IOptions`, and live-reloaded via `IOptionsMonitor` when SSE is enabled — no restart needed. See [ASP.NET Core configuration](/sdks/dotnet/aspnetcore-configuration). ## What's new in v0.5.1 * **Requires .NET 8 or later** - target framework widened to `net8.0`. Supports .NET 8, 9, 10, and later. * **Security improvements** - response bodies are no longer embedded in exception messages; `file`-type secret paths are fully hashed; key names are never stored on the filesystem. * **Reliable `GetSecretAsync`** - all code paths return a properly awaitable `Task`, consistent with async/await conventions throughout the SDK. * **Thread-safe WIF session** - concurrent token refresh calls are serialised to prevent redundant token exchanges. * **CI** - test stage runs on every MR; publish is restricted to `main`-branch tags. ## What's new in v0.5.0 * **Write API** - `SetSecretAsync`, `DeleteSecretAsync`, `DeleteSecretVersionAsync` for programmatic secret management. secret keys only; public keys throw `NexusPublicKeyException` immediately without a network call. * **`NexusRateLimitedException`** - new exception for HTTP 429 on write endpoints. ## What's new in v0.3.1 * **`Retry-After`-aware SSE 429 handling** - `RunStreamAsync` now `await Task.Delay`-s the indicated duration (clamped `[5 s, 5 min]`) and reconnects automatically when the server returns `429` with a parseable `Retry-After` header (delta-seconds or HTTP-date form). Without `Retry-After`, the legacy terminate-on-429 + TTL polling fallback is preserved. ## What's new in v0.3.0 * **AB Testing add-on** - new `EvaluateABAsync(keys, userId, attributes, ct)` for batch per-user flag evaluation. Throws `NexusAbAddonNotAvailableException` on 403. * **File-type secrets** - secrets now carry a `type` field; `file`-type values are materialised to temp files under `Path.GetTempPath()` and exposed via `GetSecretFilePath(key)`. Temp files are cleaned up by `Dispose()`. ## What's new in v0.2.0 * **Workload Identity Federation** - Kubernetes / AWS IRSA / GCP / Azure auto-detected; bearer-JWT auth with automatic refresh. * **Stream observer hooks** - opt-in `IStreamObserver` for ops dashboards and load-test tooling. * **Service kind awareness** - `GetSecretAsync` blocked with `NexusServiceKindMismatchException` on `kind=frontend` services. * **402 Payment Required handling** - `NexusBillingException` thrown, `BillingOverdue` flag set, background sync halted, cache served. * **Split HTTP clients** - a short consumer timeout no longer truncates the SSE stream. ## Highlights * **.NET 8.0+** - single package, minimal dependencies * **Thread-safe TTL cache** with atomic snapshot replacement and ETag/304 support * **Background refresh** - request handlers are never blocked on cache expiry * **SSE live updates** - propagates remote changes within milliseconds; falls back to TTL polling after 3 transport errors * **Public-key vs secret-key access control** - public-key clients cannot fetch secrets * **ASP.NET Core `IConfiguration` integration** *(v0.7.0)* - `AddWestyx()` extension method; `IOptions` binding; `IOptionsMonitor` live reload * **OpenFeature provider** *(v0.8.0)* - `WestyxNexus.OpenFeature` sub-package; `NexusProvider` wraps an existing client and implements the standard `FeatureProvider` interface * **Workload Identity Federation** *(v0.2.0)* - Kubernetes / AWS IRSA / GCP / Azure auto-detection; bearer JWT auth; **AWS IAM (`aws_iam`)** for ECS/Fargate/Lambda/plain-EC2 *(v0.9.0)* * **Stream observer hooks** *(v0.2.0)* - structured callbacks for SSE lifecycle events * **AB Testing add-on** *(v0.3.0)* - per-user flag evaluation via `EvaluateABAsync` * **File-type secrets** *(v0.3.0)* - materialised as temp files with automatic update detection and cleanup ## Package Hosted on the [GitLab NuGet Package Registry](https://gitlab.com/westyx/nexus/sdk/dotnet/-/packages). Install: ```sh theme={null} dotnet add package WestyxNexus ``` Latest release: **v0.11.0** *(2026-07-27 - five packages, `ILogger` and `IHttpClientFactory` adoption, `IConfiguration` binding fixes, secrets binding, FeatureManagement provider)*. ## Pages | Page | Description | | ------------------------------------------------------------------- | -------------------------------------------------------------- | | [Installation](/sdks/dotnet/installation) | Add the GitLab NuGet source and install the package | | [Configuration](/sdks/dotnet/configuration) | `NexusConfig` field reference | | [API reference](/sdks/dotnet/api-reference) | Every public method and property | | [Error handling](/sdks/dotnet/error-handling) | Exception hierarchy + when each is thrown | | [SSE live updates](/sdks/dotnet/sse-live-updates) | How live propagation works | | [Stream observer](/sdks/dotnet/stream-observer) | `IStreamObserver` reference | | [Workload identity](/sdks/dotnet/workload-identity) | WIF setup, providers, custom token sources | | [Caching behaviour](/sdks/dotnet/caching-behaviour) | When does the SDK hit the network | | [ASP.NET Core configuration](/sdks/dotnet/aspnetcore-configuration) | `AddWestyx()`, `IOptions`, `IOptionsMonitor` live reload | | [OpenFeature integration](/sdks/dotnet/openfeature) | `NexusProvider` setup, value mapping, DI example |