MonoCloud.Backend 0.1.0-canary-20260630072153

Introduction

MonoCloud Backend SDK for .NET – secure access token validation for ASP.NET Core APIs and resource servers.

MonoCloud is a modern, developer-friendly Identity & Access Management platform.

This SDK enables ASP.NET Core APIs to validate incoming access tokens issued by MonoCloud. It is implemented as a standard ASP.NET Core authentication handler, so it plugs directly into AddAuthentication(), [Authorize], and the authorization policy system.

The SDK handles:

• JWT access token validation with signature and claims verification
• Opaque token introspection (RFC 7662) with automatic JWT vs. opaque detection
• Scope and group-based authorization through the standard policy system
• Optional caching of validated token claims via IMonoCloudClaimsCache
• mTLS certificate-bound token validation (RFC 8705)
• Multiple client authentication methods for introspection: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, and tls_client_auth

📘 Documentation

• Documentation: https://www.monocloud.com/docs
• API Reference: https://monocloud.github.io/backend-dotnet

Supported Platforms

This SDK supports applications targeting >= .NET 6.0

📦 Installation

dotnet add package MonoCloud.Backend

Usage

using System.Security.Claims;
using MonoCloud.Backend;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(MonoCloudAuthenticationDefaults.AuthenticationScheme)
    .AddMonoCloudAuthentication(options =>
    {
        options.TenantDomain = "https://<your-tenant-domain>";
        options.Audience = "<your-api-identifier>";

        // Required only for opaque (reference) token introspection:
        // options.ClientId = "<your-client-id>";
        // options.ClientAuth = new ClientSecretAuth("<your-client-secret>");
    });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/api/protected", (ClaimsPrincipal user) => $"Hello {user.Identity?.Name}")
   .RequireAuthorization();

app.Run();

The handler detects the token format automatically — JWTs are validated locally against the tenant's signing keys, and opaque tokens are introspected.

For full usage (scope/group authorization, client authentication methods, claims caching, mTLS certificate binding, and events), see the documentation and the GitHub repository.

📄 License

Licensed under the MIT License.