softaware.Authentication.Hmac.AspNetCore 1.0.0

.NET Standard 2.0
There is a newer version of this package available.
See the version list below for details.
dotnet add package softaware.Authentication.Hmac.AspNetCore --version 1.0.0
NuGet\Install-Package softaware.Authentication.Hmac.AspNetCore -Version 1.0.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="softaware.Authentication.Hmac.AspNetCore" Version="1.0.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add softaware.Authentication.Hmac.AspNetCore --version 1.0.0
#r "nuget: softaware.Authentication.Hmac.AspNetCore, 1.0.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install softaware.Authentication.Hmac.AspNetCore as a Cake Addin
#addin nuget:?package=softaware.Authentication.Hmac.AspNetCore&version=1.0.0

// Install softaware.Authentication.Hmac.AspNetCore as a Cake Tool
#tool nuget:?package=softaware.Authentication.Hmac.AspNetCore&version=1.0.0



Provides an AuthenticationHandler which supports HMAC authentication in an ASP.NET Core project.


  1. Get your HMAC authenticated clients, for example from the appsettings.json file. For HMAC authentication, an AppId and an ApiKey is required for each client which should get access.
var hmacAuthenticatedApps = this.Configuration
    .ToDictionary(e => e.AppId, e => e.ApiKey);
  "Authentication": {
    "HmacAuthenticatedApps": [
            "AppId": "<some-app-id>",
            "ApiKey": "<some-api-key>"
  1. Enable HMAC authentication in Startup.cs in the ConfigureServices method:
    .AddHmacAuthentication(HmacAuthenticationDefaults.AuthenticationScheme, "HMAC Authentication", o =>
        o.MaxRequestAgeInSeconds = HmacAuthenticationDefaults.MaxRequestAgeInSeconds;
        o.HmacAuthenticatedApps = hmacAuthenticatedApps;
  1. Add MemoryCache (from Microsoft.Extensions.Caching.Memory) in Startup.cs in the ConfigureServices method. The MemoryCache is used by the HMAC AuthenticationHandler to determine replay attacks.
  1. Enable authentication in Startup.cs in the Configure method:
  1. Optional: Specify HMAC as the authentication scheme for certain controllers:
[Authorize(AuthenticationSchemes = HmacAuthenticationDefaults.AuthenticationScheme)]
public class HomeController : Controller
   // ...


Provides a DelegatingHandler for adding an HMAC authorization header to HTTP requests.

Instantiate your HttpClient instance with the ApiKeyDelegatingHandler:

new HttpClient(new ApiKeyDelegatingHandler(appId, apiKey));

Or in case your WebAPI client is another ASP.NET WebAPI (>= ASP.NET Core 2.1), register your HttpClient in the Startup.cs for example as follows:

services.AddTransient(sp => new ApiKeyDelegatingHandler(appId, apiKey));


Generate HMAC AppId and ApiKey

To generate an API Key, the following simple Console Application can be used. This implementation is also provided on .NET Fiddle.

using System.Security.Cryptography;

public class Program
    public static void Main()
        Console.WriteLine($"AppID: {Guid.NewGuid()} or <some-speaking-name>");
        Console.WriteLine($"ApiKey: {GenerateApiKey()}");

    private static string GenerateApiKey()
        using (var cryptoProvider = new RNGCryptoServiceProvider())
            byte[] secretKeyByteArray = new byte[32]; //256 bit
            return Convert.ToBase64String(secretKeyByteArray);

Product Compatible and additional computed target framework versions.
.NET net5.0 was computed.  net5.0-windows was computed.  net6.0 was computed.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp2.0 was computed.  netcoreapp2.1 was computed.  netcoreapp2.2 was computed.  netcoreapp3.0 was computed.  netcoreapp3.1 was computed. 
.NET Standard netstandard2.0 is compatible.  netstandard2.1 was computed. 
.NET Framework net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
MonoAndroid monoandroid was computed. 
MonoMac monomac was computed. 
MonoTouch monotouch was computed. 
Tizen tizen40 was computed.  tizen60 was computed. 
Xamarin.iOS xamarinios was computed. 
Xamarin.Mac xamarinmac was computed. 
Xamarin.TVOS xamarintvos was computed. 
Xamarin.WatchOS xamarinwatchos was computed. 
Compatible target framework(s)
Additional computed target framework(s)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
4.0.1 2,160 7/20/2023
4.0.0 5,799 3/27/2023
3.4.0 201 3/23/2023
3.3.0 24,207 3/28/2022
3.2.0 30,805 11/2/2020
3.1.0 18,703 12/18/2019
3.0.0 829 12/9/2019
1.1.0 2,847 12/13/2018
1.0.1 679 9/24/2018
1.0.0 835 7/11/2018