SDKs · .NETIn developmentView source

RootHerald.AspNetCore

ASP.NET Core server-side integration. Covers both halves of the model: the server→server Background-Check default (appraise client evidence with your rh_sk_ secret key and get the verdict directly) and the offline token path — a JWT handler, a RequireRootHerald() policy, and a strongly-typed HttpContext.GetRootHeraldVerdict() for the portable-token / badge tier. Pure managed C#, no native dependencies. Targets .NET 8 LTS and .NET 9.

In development

This SDK is implemented but not yet published to its package registry. Until it ships, mint attestation tokens on the device and verify them server-side with @rootherald/node (or any available server SDK). The API shown below is the planned surface and may change before release.

Install

dotnet CLIbash

dotnet add package RootHerald.AspNetCore

Register authentication

Program.cscsharp

using RootHerald.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRootHeraldAuthentication(o =>
{
    o.Issuer = "https://api.rootherald.io";
    o.Audience = "plat_your_client_id";
});

builder.Services.AddAuthorization(o =>
    o.AddPolicy("RootHeraldAttested", p => p.RequireRootHerald()));

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

Require attestation on an endpoint

Gate any endpoint with the policy, then read the verified verdict off HttpContext. GetRootHeraldVerdict() returns a strongly-typed result. Device.DeviceId is a stable per-tenant pseudonym you can use for one-device-one-account enforcement.

Endpoints.cscsharp

app.MapGet("/me", (HttpContext ctx) =>
    Results.Json(new { device = ctx.GetRootHeraldVerdict()?.Device.DeviceId }))
   .RequireAuthorization("RootHeraldAttested");

Why the API looks like this

The package follows the platform's .NET conventions (MSDN PascalCase, async-first, options-pattern config) and the standard ASP.NET Core authentication/authorization extension points, so it composes with the policies and middleware you already have. A runnable RootHerald.AspNetCore.Sample project ships in the SDK repo. The separate RootHerald.Native package (FFI to the native client, for driving TPM attestation from C# desktop apps) is a preview and tracked separately.