---
title: C# SDK
description: Install and use the official Sudomimus .NET packages.
editUrl: true
head: []
template: doc
sidebar:
  order: 4
  hidden: false
  attrs: {}
pagefind: true
draft: false
---

import { CardGrid, LinkCard } from "@astrojs/starlight/components";

The C# SDK publishes .NET packages for the Connect, Session, Native, and Token surfaces. Device authorization does not currently have a C# package; use the [Device API reference](/en-us/api/device/) directly for that flow.

## Packages

| Package | Use it for |
| --- | --- |
| `Sudomimus.Connect` | Connect inquiry lifecycle and token verification through application metadata. |
| `Sudomimus.Session` | Refresh, introspection, logout, revoke-all, and helper token stores. |
| `Sudomimus.Native` | Steam ticket and AccessKey direct-issue. |
| `Sudomimus.Token` | Standalone token parsing and verification helpers. |

Install the packages your integration needs:

```bash
dotnet add package Sudomimus.Connect
dotnet add package Sudomimus.Session
```

## Connect

```csharp
using Sudomimus.Connect;

var client = new ConnectClient(new ConnectClientOptions
{
    ClientAuth = new ConnectClientAuthWithKey
    {
        ApplicationAnchor = "your-app-anchor",
        PrivateKeyPem = File.ReadAllText("client-auth.pem"),
    },
});

var inquiry = await client.EstablishAsync(new EstablishRequest
{
    ApplicationAnchor = "your-app-anchor",
});
```

`/establish` requires a client-auth JWT with audience `sudomimus-connect`. Configure `ConnectClientOptions.ClientAuth` to let the SDK sign it, or provide your own signer.

## Sessions

```csharp
using Sudomimus.Session;

var session = new RotatingSessionClient(
    new SessionClient(),
    new InMemoryTokenStore());

await session.SeedAsync(new TokenPair
{
    AccessToken = accessToken,
    RefreshToken = refreshToken,
});

var newAccessToken = await session.RefreshAsync();
await session.LogoutAsync();
```

`RevokeAllAsync` is an application-backend operation and requires client-auth signing with audience `sudomimus-session`.

## Token Verification

Token verification is independent of Connect. Resolve the token's `kid` from the per-application Session JWK Set at `GET /applications/{applicationAnchor}/jwks.json`, cache it according to `Cache-Control`, and use `Sudomimus.Token` for parsing and signature verification. Connect `/info` only returns localized application metadata.

After verification, use payload `sub` as the application-visible user key,
payload `sid` as the logical session id, and payload `jti` as the bearer-instance
id. Access tokens contain no profile fields; refresh tokens contain no user
identifier and add `rotationVersion`. Fetch current profile data from Session
`/userinfo`. Signature-only verification cannot observe later
logout, so use Session introspection for live-authority decisions.

## Source

<CardGrid>
<LinkCard
    title=".NET packages"
    description="Source and package README files."
    href="https://github.com/sudomimus/sudomimus/tree/master/sdks/csharp/src"
/>
<LinkCard
    title="SDK overview"
    description="How the official SDKs map to Sudomimus APIs."
    href="/en-us/sdk/overview/"
/>
</CardGrid>