C# SDK

The C# SDK publishes .NET packages for the Connect, Session, Native, and Token surfaces. Device authorization does not currently have a C# package; use the Device API reference directly for that flow.

Packages

Package	Use it for
Sudomimus.Connect	Connect inquiry lifecycle and token verification through application metadata.
Sudomimus.Session	Refresh, introspection, logout, revoke-all, and helper token stores.
Sudomimus.Native	Steam ticket and AccessKey direct-issue.
Sudomimus.Token	Standalone token parsing and verification helpers.

Install the packages your integration needs:

dotnet add package Sudomimus.Connect
dotnet add package Sudomimus.Session

Connect

using Sudomimus.Connect;

var client = new ConnectClient(new ConnectClientOptions
{
    ClientAuth = new ConnectClientAuthWithKey
    {
        ApplicationAnchor = "your-app-anchor",
        PrivateKeyPem = File.ReadAllText("client-auth.pem"),
    },
});

var inquiry = await client.EstablishAsync(new EstablishRequest
{
    ApplicationAnchor = "your-app-anchor",
});

/establish requires a client-auth JWT with audience sudomimus-connect. Configure ConnectClientOptions.ClientAuth to let the SDK sign it, or provide your own signer.

Sessions

using Sudomimus.Session;

var session = new RotatingSessionClient(
    new SessionClient(),
    new InMemoryTokenStore());

await session.SeedAsync(new TokenPair
{
    AccessToken = accessToken,
    RefreshToken = refreshToken,
});

var newAccessToken = await session.RefreshAsync();
await session.LogoutAsync();

RevokeAllAsync is an application-backend operation and requires client-auth signing with audience sudomimus-session.

Token Verification

Token verification is independent of Connect. Resolve the token’s kid from the per-application Session JWK Set at GET /applications/{applicationAnchor}/jwks.json, cache it according to Cache-Control, and use Sudomimus.Token for parsing and signature verification. Connect /info only returns localized application metadata.

After verification, use payload sub as the application-visible user key, payload sid as the logical session id, and payload jti as the bearer-instance id. Access tokens contain no profile fields; refresh tokens contain no user identifier and add rotationVersion. Fetch current profile data from Session /userinfo. Signature-only verification cannot observe later logout, so use Session introspection for live-authority decisions.

Source

.NET packagesSource and package README files.

SDK overviewHow the official SDKs map to Sudomimus APIs.