Samples

Six samples in samples/. Each is the same shape — a client signing requests to an API that verifies them — differing in one thing, so the diff between two of them is the feature.

Running one

Each .NET sample has an Api and a client project. Both have to be running: start the API first, then the client.

cd samples/WebToApiAuthentication
dotnet run --project Api
dotnet run --project Web    # in a second terminal

Then open the client’s URL. It reports what the API returned for a signed GET and a signed POST.

The two samples that use the TypeScript client link it from source, so build it once first:

cd client/lib && npm ci && npm run build

Inside a sample use npm install, not npm ci — the dependency is a file: link to client/lib, so there is nothing external to pin and no lockfile is committed.

Everything listens on plain HTTP on localhost, so no development certificate is needed. HMAC authenticates a request and detects tampering; it does not encrypt one, so a real deployment still belongs behind TLS.

The keys

The keys in the samples are literals committed to the repository. Every sample uses the same key pair on purpose, so that the only difference between any two of them is the feature being shown. They are not examples of key handling — see configuration binding for where a real key belongs.