.NET SDK - API Reference

Every public method and property on NexusClient. All read methods are non-blocking - they hit the in-memory cache. Only CreateAsync() and SyncAsync() make network calls.

Construction

`NexusClient.CreateAsync(NexusConfig, CancellationToken = default)`

Creates a client and runs a blocking initial sync. The returned Task<NexusClient> resolves only after the first sync completes.

await using var client = await NexusClient.CreateAsync(new NexusConfig
{
    BaseUrl = "...",
    ApiKey  = "...",
});

Throws	When
`NexusInitException`	Initial sync failed - `InnerException` has the underlying cause
`ArgumentException`	`BaseUrl` or `ApiKey` missing or invalid

Configs

`(JsonElement? value, bool found) GetConfig(string key)`

Returns the resolved config value as a JsonElement (the wire-level JSON node), and a found boolean.

var (value, found) = client.GetConfig("database.url");
if (found)
    Console.WriteLine(value!.Value.GetString());

The value is whatever JSON shape the server stored - string, number, boolean, array, or object.

`IReadOnlyDictionary<string, JsonElement> GetAllConfigs()`

Snapshot copy of every config key-value pair currently in the cache. public-key clients receive every config and flag the service exposes - visibility is decided server-side, with no per-entry field for a client to reason about.

Feature flags

`bool GetFlag(string key, bool defaultValue = false)`

Returns the is_active state of a flag, or defaultValue when the key is absent.

bool isOn = client.GetFlag("checkout.v2");                  // false if missing
bool isOn = client.GetFlag("checkout.v2", defaultValue: true);

`IReadOnlyDictionary<string, bool> GetAllFlags()`

Snapshot copy of every flag key-is_active pair in the cache.

AB Testing

`Task<IReadOnlyDictionary<string, bool>> EvaluateABAsync(IEnumerable<string> keys, string userId, IDictionary<string, object>? attributes, CancellationToken = default)`

Evaluates one or more feature flags against the AB Testing add-on. Unlike GetFlag, this method always makes a network call.

var results = await client.EvaluateABAsync(
    keys: new[] { "checkout.v2", "homepage.banner" },
    userId: "user-42",
    attributes: new Dictionary<string, object>
    {
        ["country"] = "DE",
        ["plan"]    = "pro",
    });

bool checkoutV2 = results["checkout.v2"];

attributes may be null - it is serialised as an empty object.

Throws	When
`NexusAbAddonNotAvailableException`	Server returned HTTP 403 - the AB Testing add-on is not active for the tenant
`NexusUnauthorizedException`	Server returned HTTP 401
`NexusBillingException`	Server returned HTTP 402 - tenant has overdue invoices
`NexusNotFoundException`	Server returned HTTP 404
`ArgumentNullException`	`keys` is `null`

Secrets (secret key only)

`string GetSecret(string key)`

Returns the plaintext value of a secret. It reads the in-memory cache and makes no network call, which is why it returns a string rather than a Task<string>; it pairs with GetSecretFilePath, which is synchronous for the same reason.

string dbPass = client.GetSecret("DB_PASSWORD");

Throws	When
`NexusPublicKeyException`	The client uses a public key
`NexusServiceKindMismatchException`	The service’s kind is `frontend`
`NexusSecretNotFoundException`	The key is not in the cache

`string? GetSecretFilePath(string key)`

Returns the absolute filesystem path of a materialised file-type secret, or null when the key is unknown or refers to a text-type secret. Always non-blocking.

string? certPath = client.GetSecretFilePath("tls.cert");
if (certPath is not null)
    using var cert = X509Certificate2.CreateFromPemFile(certPath);

File-type secrets

file-type secrets are materialised during every sync into a directory the client owns:

<temp>/nexus-secrets-<random>/nexus-<keyhash>-<valuehash>

The directory is created 0700 with an unguessable name, and each file inside it is created exclusively at 0600 with the mode applied by the creating call rather than by a chmod afterwards. Both filename components are the first 16 hex characters of a SHA-256 digest, so neither the key name nor the value appears in the path. Because the value hash is part of the name, the path changes whenever the value changes - a consumer can detect a rotation by polling GetSecretFilePath. The directory component is per client instance, so two clients holding the same secret get separate files and one client’s disposal cannot remove the other’s; do not persist the path beyond the client’s lifetime. Files for secrets that disappear from a sync, or switch back to text, are deleted. The directory and everything in it are removed by Dispose() / DisposeAsync(), and a process-exit hook removes them if the process ends without disposing. On Windows there is no 0600 equivalent: the directory and its files inherit the user-scoped temp ACL.

Secrets - Write API (v0.5.0) (secret key only)

`Task SetSecretAsync(string key, string value, CancellationToken = default)`

Creates or updates a secret with the given key and value.

await client.SetSecretAsync("DB_PASSWORD", "new-password");
await client.SetSecretAsync("TLS_CERT", certPem);

Throws	When
`NexusPublicKeyException`	The client uses a public key
`NexusRateLimitedException`	Server returned HTTP 429 - rate limit exceeded on write endpoints
`NexusUnauthorizedException`	Server returned HTTP 401
`NexusServiceKindMismatchException`	The service `kind` is `"frontend"`

`Task DeleteSecretAsync(string key, CancellationToken = default)`

Deletes a secret by key.

await client.DeleteSecretAsync("DEPRECATED_API_KEY");

Throws	When
`NexusPublicKeyException`	The client uses a public key
`NexusRateLimitedException`	Server returned HTTP 429 - rate limit exceeded on write endpoints
`NexusUnauthorizedException`	Server returned HTTP 401
`NexusServiceKindMismatchException`	The service `kind` is `"frontend"`

`Task DeleteSecretVersionAsync(string key, int version, CancellationToken = default)` (v0.5.0)

Deletes a specific version of a secret.

await client.DeleteSecretVersionAsync("DB_PASSWORD", version: 3);

Throws	When
`NexusPublicKeyException`	The client uses a public key
`NexusRateLimitedException`	Server returned HTTP 429 - rate limit exceeded on write endpoints
`NexusUnauthorizedException`	Server returned HTTP 401
`NexusServiceKindMismatchException`	The service `kind` is `"frontend"`

Disposing the client

Always dispose the client via Dispose() / DisposeAsync() (or await using) on shutdown. Disposal:

Cancels the SSE background task (if ConnectStream() was ever called).
Deletes every temp file written for file-type secrets.
Releases the internally-managed HttpClient instances.

await using var client = await NexusClient.CreateAsync(config);
// ... application work ...
// On scope exit: stream stops, temp files removed, HttpClient disposed.

Metadata

Property	Type	Description
`KeyType`	`KeyType`	`Secret`, `Public`, or `None` (no API key - WIF-only client) - derived from the configured `ApiKey` and, where available, the backend’s `key_type`
`Kind`	`ServiceKind`	`Frontend`, `Backend`, or `Unknown` (not yet synced, or a kind this SDK version does not recognise) - reported by the backend on `/v1/sync` or the WIF token exchange
`KindName`	`string`	The service kind exactly as the backend sent it, empty until known
`SyncedAt`	`DateTimeOffset`	Timestamp of the last successful sync
`IsStreamConnected`	`bool`	`true` while the SSE stream is connected and pushing events
`BillingOverdue`	`bool`	`true` after the most recent sync returned HTTP 402; clears on the next successful sync (a `304` included)

Sync / lifecycle

`Task SyncAsync(CancellationToken = default)`

Forces a sync now, bypassing the TTL. Atomically replaces the cache. ETag / If-None-Match is used automatically; a 304 resets the TTL without downloading data. Rarely needed.

`void ConnectStream()`

Starts the SSE live-update background task. Idempotent - calling more than once is a no-op. See SSE live updates.

`void DisconnectStream()`

Stops the SSE task. Safe to call multiple times.

`Dispose()` / `DisposeAsync()`

Stops the SSE background task, deletes any file-type secret temp files, and releases the internally-managed HttpClient. Always call (or use await using) before the application exits.

Overview

Backend SDKs

Browser SDKs

OpenFeature Providers

.NET SDK - API Reference

Construction

`NexusClient.CreateAsync(NexusConfig, CancellationToken = default)`

Configs

`(JsonElement? value, bool found) GetConfig(string key)`

`IReadOnlyDictionary<string, JsonElement> GetAllConfigs()`

Feature flags

`bool GetFlag(string key, bool defaultValue = false)`

`IReadOnlyDictionary<string, bool> GetAllFlags()`

AB Testing

`Task<IReadOnlyDictionary<string, bool>> EvaluateABAsync(IEnumerable<string> keys, string userId, IDictionary<string, object>? attributes, CancellationToken = default)`

Secrets (secret key only)

`string GetSecret(string key)`

`string? GetSecretFilePath(string key)`

File-type secrets

Secrets - Write API (v0.5.0) (secret key only)

`Task SetSecretAsync(string key, string value, CancellationToken = default)`

`Task DeleteSecretAsync(string key, CancellationToken = default)`

`Task DeleteSecretVersionAsync(string key, int version, CancellationToken = default)` (v0.5.0)

Disposing the client

Metadata

Sync / lifecycle

`Task SyncAsync(CancellationToken = default)`

`void ConnectStream()`

`void DisconnectStream()`

`Dispose()` / `DisposeAsync()`

​Construction

​NexusClient.CreateAsync(NexusConfig, CancellationToken = default)

​Configs

​(JsonElement? value, bool found) GetConfig(string key)

​IReadOnlyDictionary<string, JsonElement> GetAllConfigs()

​Feature flags

​bool GetFlag(string key, bool defaultValue = false)

​IReadOnlyDictionary<string, bool> GetAllFlags()

​AB Testing

​Task<IReadOnlyDictionary<string, bool>> EvaluateABAsync(IEnumerable<string> keys, string userId, IDictionary<string, object>? attributes, CancellationToken = default)

​Secrets (secret key only)

​string GetSecret(string key)

​string? GetSecretFilePath(string key)

​File-type secrets

​Secrets - Write API (v0.5.0) (secret key only)

​Task SetSecretAsync(string key, string value, CancellationToken = default)

​Task DeleteSecretAsync(string key, CancellationToken = default)

​Task DeleteSecretVersionAsync(string key, int version, CancellationToken = default) (v0.5.0)

​Disposing the client

​Metadata

​Sync / lifecycle

​Task SyncAsync(CancellationToken = default)

​void ConnectStream()

​void DisconnectStream()

​Dispose() / DisposeAsync()

Construction

`NexusClient.CreateAsync(NexusConfig, CancellationToken = default)`

Configs

`(JsonElement? value, bool found) GetConfig(string key)`

`IReadOnlyDictionary<string, JsonElement> GetAllConfigs()`

Feature flags

`bool GetFlag(string key, bool defaultValue = false)`

`IReadOnlyDictionary<string, bool> GetAllFlags()`

AB Testing

`Task<IReadOnlyDictionary<string, bool>> EvaluateABAsync(IEnumerable<string> keys, string userId, IDictionary<string, object>? attributes, CancellationToken = default)`

Secrets (secret key only)

`string GetSecret(string key)`

`string? GetSecretFilePath(string key)`

File-type secrets

Secrets - Write API (v0.5.0) (secret key only)

`Task SetSecretAsync(string key, string value, CancellationToken = default)`

`Task DeleteSecretAsync(string key, CancellationToken = default)`

`Task DeleteSecretVersionAsync(string key, int version, CancellationToken = default)` (v0.5.0)

Disposing the client

Metadata

Sync / lifecycle

`Task SyncAsync(CancellationToken = default)`

`void ConnectStream()`

`void DisconnectStream()`

`Dispose()` / `DisposeAsync()`