.NET SDK

await using var client = await NexusClient.CreateAsync(new NexusConfig
{
    BaseUrl = "https://blue-ocean-a5rx7.westyx.dev",
    ApiKey  = "wxs_...",
});

client.ConnectStream();

var (dbUrl, found) = client.GetConfig("database.url");
string stripeKey   = await client.GetSecretAsync("stripe.key");
bool   newCheckout = client.GetFlag("new.checkout", defaultValue: false);

​

What’s new in v0.11.0

• BREAKING - AddWestyx() moved to WestyxNexus.Extensions.Configuration. Add the package reference; the namespace is unchanged, so no code edit.
• BREAKING - multi-targeted net8.0;net10.0. .NET 8 goes out of support on 2026-11-10; .NET 10 is the current LTS (to 2028-11-14).
• NexusConfig.LoggerFactory takes a standard ILoggerFactory; INexusLogger is obsolete but still bridged. Log statements are structured, under the categories Westyx.Nexus.NexusClient, Westyx.Nexus.Stream and Westyx.Nexus.Wif.
• Async startup. AddWestyxNexus() runs the initial sync in an IHostedService instead of blocking a thread-pool thread.
• NexusConfig.PooledConnectionLifetime (default 2 minutes). The framework default is infinite, so an application-lifetime singleton never recycled a connection and never observed a DNS change.
• IConfiguration binding fixed twice - dotted keys are now section-navigable (GetSection("database") used to come back empty and bind nothing), and JSON objects and arrays are flattened instead of stored as one opaque string.
• AddWestyxNexusSecrets<T>() binds secrets to IOptions<T> with live re-bind, without putting them in IConfiguration.
• AddWestyxNexusFeatureManagement() serves Nexus flags to IFeatureManager from the in-memory cache.

• File-type secrets are now written owner-readable only (0600). They previously used the process umask - typically 0644 on Linux, readable by every local user on the machine.
• Two clients holding the same secret no longer share one temp file; the first disposed used to delete it out from under the other.
• The post-sync notification is additive - it was a single slot, so using both the configuration provider and the secrets binder silently disabled live reload on one of them.

​

What’s new in v0.10.0

• Version alignment across the Westyx Nexus SDK suite.

​

What’s new in v0.9.0

• aws_iam WIF provider (AWS IAM Caller Identity) - authenticates non-EKS AWS compute (ECS/Fargate, Lambda, plain EC2) that has IAM credentials but no OIDC token. The SDK SigV4-signs an STS GetCallerIdentity request (never sent to AWS) and posts it to /v1/auth/token-exchange; Nexus replays it against a pinned STS endpoint to prove your IAM role. The signed X-Nexus-Server-ID is your service’s own base-URL host - a captured request is valid for that one service only, and there is nothing to configure. Uses AWSSDK.Core for the credential/region chain only. See Workload identity.
• Azure Workload Identity (AKS) - the Azure provider now prefers the projected federated token file ($AZURE_FEDERATED_TOKEN_FILE) before falling back to IMDS; auto-detection probes the file too.
• Probe-based auto-detection - auto-detect now stats the Kubernetes / AWS-IRSA / Azure token files and live-probes the GCP and Azure metadata servers (~1 s timeout), instead of keying on environment variables absent on real cloud nodes.
• Security hardening - NexusClient.CreateAsync rejects plain-http BaseUrls (loopback excepted); the Azure IMDS path refuses the generic default audience (must be api://<client-id>); expired WIF sessions fail closed; the metadata client disables redirects and the system proxy; metadata/exchange reads are bounded.

​

What’s new in v0.8.0

• WestyxNexus.OpenFeature NuGet sub-package - install WestyxNexus.OpenFeature alongside WestyxNexus and register NexusProvider as an OpenFeature provider. Feature flags resolve via ResolveBooleanValue; configs via ResolveString/Double/Integer/StructureValue. All reads are cache-backed. See OpenFeature integration.

​

What’s new in v0.7.0

• ASP.NET Core IConfiguration integration - builder.Configuration.AddWestyx(nexusConfig) plugs Nexus into the standard configuration pipeline. All config values are accessible via IConfiguration, bindable via IOptions<T>, and live-reloaded via IOptionsMonitor<T> when SSE is enabled — no restart needed. See ASP.NET Core configuration.

​

What’s new in v0.5.1

• Requires .NET 8 or later - target framework widened to net8.0. Supports .NET 8, 9, 10, and later.
• Security improvements - response bodies are no longer embedded in exception messages; file-type secret paths are fully hashed; key names are never stored on the filesystem.
• Reliable GetSecretAsync - all code paths return a properly awaitable Task, consistent with async/await conventions throughout the SDK.
• Thread-safe WIF session - concurrent token refresh calls are serialised to prevent redundant token exchanges.
• CI - test stage runs on every MR; publish is restricted to main-branch tags.

​

What’s new in v0.5.0

• Write API - SetSecretAsync, DeleteSecretAsync, DeleteSecretVersionAsync for programmatic secret management. secret keys only; public keys throw NexusPublicKeyException immediately without a network call.
• NexusRateLimitedException - new exception for HTTP 429 on write endpoints.

​

What’s new in v0.3.1

• Retry-After-aware SSE 429 handling - RunStreamAsync now await Task.Delay-s the indicated duration (clamped [5 s, 5 min]) and reconnects automatically when the server returns 429 with a parseable Retry-After header (delta-seconds or HTTP-date form). Without Retry-After, the legacy terminate-on-429 + TTL polling fallback is preserved.

​

What’s new in v0.3.0

• AB Testing add-on - new EvaluateABAsync(keys, userId, attributes, ct) for batch per-user flag evaluation. Throws NexusAbAddonNotAvailableException on 403.
• File-type secrets - secrets now carry a type field; file-type values are materialised to temp files under Path.GetTempPath() and exposed via GetSecretFilePath(key). Temp files are cleaned up by Dispose().

​

What’s new in v0.2.0

• Workload Identity Federation - Kubernetes / AWS IRSA / GCP / Azure auto-detected; bearer-JWT auth with automatic refresh.
• Stream observer hooks - opt-in IStreamObserver for ops dashboards and load-test tooling.
• Service kind awareness - GetSecretAsync blocked with NexusServiceKindMismatchException on kind=frontend services.
• 402 Payment Required handling - NexusBillingException thrown, BillingOverdue flag set, background sync halted, cache served.
• Split HTTP clients - a short consumer timeout no longer truncates the SSE stream.

​

Highlights

• .NET 8.0+ - single package, minimal dependencies
• Thread-safe TTL cache with atomic snapshot replacement and ETag/304 support
• Background refresh - request handlers are never blocked on cache expiry
• SSE live updates - propagates remote changes within milliseconds; falls back to TTL polling after 3 transport errors
• Public-key vs secret-key access control - public-key clients cannot fetch secrets
• ASP.NET Core IConfiguration integration (v0.7.0) - AddWestyx() extension method; IOptions<T> binding; IOptionsMonitor<T> live reload
• OpenFeature provider (v0.8.0) - WestyxNexus.OpenFeature sub-package; NexusProvider wraps an existing client and implements the standard FeatureProvider interface
• Workload Identity Federation (v0.2.0) - Kubernetes / AWS IRSA / GCP / Azure auto-detection; bearer JWT auth; AWS IAM (aws_iam) for ECS/Fargate/Lambda/plain-EC2 (v0.9.0)
• Stream observer hooks (v0.2.0) - structured callbacks for SSE lifecycle events
• AB Testing add-on (v0.3.0) - per-user flag evaluation via EvaluateABAsync
• File-type secrets (v0.3.0) - materialised as temp files with automatic update detection and cleanup

​

Package

dotnet add package WestyxNexus

​

Pages