> ## Documentation Index > Fetch the complete documentation index at: https://docs.westyx.cloud/llms.txt > Use this file to discover all available pages before exploring further. # .NET SDK > Official .NET SDK for Westyx Nexus - minimal dependencies, async/await, DI-ready. Official .NET SDK for [Westyx Nexus](https://westyx.dev) - the centralised secrets, feature flags, and config service. ```csharp theme={null} await using var client = await NexusClient.CreateAsync(new NexusConfig { BaseUrl = "https://blue-ocean-a5rx7.westyx.dev", ApiKey = "wxs_...", }); client.ConnectStream(); var (dbUrl, found) = client.GetConfig("database.url"); string stripeKey = await client.GetSecretAsync("stripe.key"); bool newCheckout = client.GetFlag("new.checkout", defaultValue: false); ``` ## What's new in v0.10.0 * Version alignment across the Westyx Nexus SDK suite. ## What's new in v0.9.0 * **`aws_iam` WIF provider (AWS IAM Caller Identity)** - authenticates non-EKS AWS compute (**ECS/Fargate, Lambda, plain EC2**) that has IAM credentials but no OIDC token. The SDK SigV4-signs an STS `GetCallerIdentity` request (never sent to AWS) and posts it to `/v1/auth/token-exchange`; Nexus replays it against a pinned STS endpoint to prove your IAM role. The signed `X-Nexus-Server-ID` is your service's own base-URL host - a captured request is valid for that one service only, and there is nothing to configure. Uses `AWSSDK.Core` for the credential/region chain only. See [Workload identity](workload-identity#aws-iam-non-eks-aws-compute). * **Azure Workload Identity (AKS)** - the `Azure` provider now prefers the projected federated token file (`$AZURE_FEDERATED_TOKEN_FILE`) before falling back to IMDS; auto-detection probes the file too. * **Probe-based auto-detection** - auto-detect now stats the Kubernetes / AWS-IRSA / Azure token files and live-probes the GCP and Azure metadata servers (\~1 s timeout), instead of keying on environment variables absent on real cloud nodes. * **Security hardening** - `NexusClient.CreateAsync` rejects plain-http `BaseUrl`s (loopback excepted); the Azure IMDS path refuses the generic default audience (must be `api://`); expired WIF sessions fail closed; the metadata client disables redirects and the system proxy; metadata/exchange reads are bounded. ## What's new in v0.8.0 * **`WestyxNexus.OpenFeature` NuGet sub-package** - install `WestyxNexus.OpenFeature` alongside `WestyxNexus` and register `NexusProvider` as an OpenFeature provider. Feature flags resolve via `ResolveBooleanValue`; configs via `ResolveString/Double/Integer/StructureValue`. All reads are cache-backed. See [OpenFeature integration](openfeature). ## What's new in v0.7.0 * **ASP.NET Core `IConfiguration` integration** - `builder.Configuration.AddWestyx(nexusConfig)` plugs Nexus into the standard configuration pipeline. All config values are accessible via `IConfiguration`, bindable via `IOptions`, and live-reloaded via `IOptionsMonitor` when SSE is enabled — no restart needed. See [ASP.NET Core configuration](aspnetcore-configuration). ## What's new in v0.5.1 * **Requires .NET 8 or later** - target framework widened to `net8.0`. Supports .NET 8, 9, 10, and later. * **Security improvements** - response bodies are no longer embedded in exception messages; `file`-type secret paths are fully hashed; key names are never stored on the filesystem. * **Reliable `GetSecretAsync`** - all code paths return a properly awaitable `Task`, consistent with async/await conventions throughout the SDK. * **Thread-safe WIF session** - concurrent token refresh calls are serialised to prevent redundant token exchanges. * **CI** - test stage runs on every MR; publish is restricted to `main`-branch tags. ## What's new in v0.5.0 * **Write API** - `SetSecretAsync`, `DeleteSecretAsync`, `DeleteSecretVersionAsync` for programmatic secret management. secret keys only; public keys throw `NexusPublicKeyException` immediately without a network call. * **`NexusRateLimitedException`** - new exception for HTTP 429 on write endpoints. ## What's new in v0.3.1 * **`Retry-After`-aware SSE 429 handling** - `RunStreamAsync` now `await Task.Delay`-s the indicated duration (clamped `[5 s, 5 min]`) and reconnects automatically when the server returns `429` with a parseable `Retry-After` header (delta-seconds or HTTP-date form). Without `Retry-After`, the legacy terminate-on-429 + TTL polling fallback is preserved. ## What's new in v0.3.0 * **AB Testing add-on** - new `EvaluateABAsync(keys, userId, attributes, ct)` for batch per-user flag evaluation. Throws `NexusAbAddonNotAvailableException` on 403. * **File-type secrets** - secrets now carry a `type` field; `file`-type values are materialised to temp files under `Path.GetTempPath()` and exposed via `GetSecretFilePath(key)`. Temp files are cleaned up by `Dispose()`. ## What's new in v0.2.0 * **Workload Identity Federation** - Kubernetes / AWS IRSA / GCP / Azure auto-detected; bearer-JWT auth with automatic refresh. * **Stream observer hooks** - opt-in `IStreamObserver` for ops dashboards and load-test tooling. * **Service kind awareness** - `GetSecretAsync` blocked with `NexusServiceKindMismatchException` on `kind=frontend` services. * **402 Payment Required handling** - `NexusBillingException` thrown, `BillingOverdue` flag set, background sync halted, cache served. * **Split HTTP clients** - a short consumer timeout no longer truncates the SSE stream. ## Highlights * **.NET 8.0+** - single package, minimal dependencies * **Thread-safe TTL cache** with atomic snapshot replacement and ETag/304 support * **Background refresh** - request handlers are never blocked on cache expiry * **SSE live updates** - propagates remote changes within milliseconds; falls back to TTL polling after 3 transport errors * **Public-key vs secret-key access control** - public-key clients cannot fetch secrets * **ASP.NET Core `IConfiguration` integration** *(v0.7.0)* - `AddWestyx()` extension method; `IOptions` binding; `IOptionsMonitor` live reload * **OpenFeature provider** *(v0.8.0)* - `WestyxNexus.OpenFeature` sub-package; `NexusProvider` wraps an existing client and implements the standard `FeatureProvider` interface * **Workload Identity Federation** *(v0.2.0)* - Kubernetes / AWS IRSA / GCP / Azure auto-detection; bearer JWT auth; **AWS IAM (`aws_iam`)** for ECS/Fargate/Lambda/plain-EC2 *(v0.9.0)* * **Stream observer hooks** *(v0.2.0)* - structured callbacks for SSE lifecycle events * **AB Testing add-on** *(v0.3.0)* - per-user flag evaluation via `EvaluateABAsync` * **File-type secrets** *(v0.3.0)* - materialised as temp files with automatic update detection and cleanup ## Package Hosted on the [GitLab NuGet Package Registry](https://gitlab.com/westyx/nexus/sdk/dotnet/-/packages). Install: ```sh theme={null} dotnet add package WestyxNexus ``` Latest release: **v0.10.0** *(2026-07-05 - version alignment across the Westyx Nexus SDK suite)*. ## Pages | Page | Description | | ------------------------------------------------------ | -------------------------------------------------------------- | | [Installation](installation) | Add the GitLab NuGet source and install the package | | [Configuration](configuration) | `NexusConfig` field reference | | [API reference](api-reference) | Every public method and property | | [Error handling](error-handling) | Exception hierarchy + when each is thrown | | [SSE live updates](sse-live-updates) | How live propagation works | | [Stream observer](stream-observer) | `IStreamObserver` reference | | [Workload identity](workload-identity) | WIF setup, providers, custom token sources | | [Caching behaviour](caching-behaviour) | When does the SDK hit the network | | [ASP.NET Core configuration](aspnetcore-configuration) | `AddWestyx()`, `IOptions`, `IOptionsMonitor` live reload | | [OpenFeature integration](openfeature) | `NexusProvider` setup, value mapping, DI example |