Configuration schema

The section passed to AddHmac or AddHmacManager binds to an array of policies.

[
  {
    "Name": "Some_Policy",
    "Keys": {
      "PublicKey": "37e3e675-370a-4ba9-af74-68f99b539f03",
      "PrivateKey": "zvg29s2cQ4idOqbUJWETOw=="
    },
    "Algorithms": {
      "ContentHashAlgorithm": "SHA256",
      "SigningHashAlgorithm": "HMACSHA256"
    },
    "Nonce": {
      "CacheType": "Memory",
      "MaxAgeInSeconds": 100
    },
    "Schemes": [
      {
        "Name": "Some_Scheme",
        "Headers": [
          {
            "Name": "Some_Header_1",
            "ClaimType": "Header_1_ClaimType"
          }
        ]
      }
    ]
  }
]

Property	Values
`Name`	Policy name, matched against the `Hmac-Policy` header
`Keys.PublicKey`	A GUID string
`Keys.PrivateKey`	A base64-encoded string
`Algorithms.ContentHashAlgorithm`	`SHA1`, `SHA256`, `SHA512`
`Algorithms.SigningHashAlgorithm`	`HMACSHA1`, `HMACSHA256`, `HMACSHA512`
`Nonce.CacheType`	`Memory`, `Distributed`
`Nonce.MaxAgeInSeconds`	Replay window, in seconds
`Schemes[].Name`	Scheme name, matched against the `Hmac-Scheme` header
`Schemes[].Headers[].Name`	Header name
`Schemes[].Headers[].ClaimType`	Claim the header maps to; defaults to the header name

Values are validated when the policy is built, so an invalid key or algorithm fails at startup rather than on the first request.

Distributed uses the registered IDistributedCache. If none is registered, it falls back to an in-process one that no other instance shares, which is logged at startup as event 1203 — see nonce and replay.

PrivateKey is a shared secret and appsettings.json is committed. Supply it from user secrets, an environment variable or a secret store and let configuration composition merge it in.

See configuration binding for how to wire it up, including reload behaviour.

Chart values