Axowl.Sdk.Identity.Client 0.2.1

Axowl.Sdk.Identity.Client

Axowl SDK for B2B consumer apps to verify Axowl-issued EndUser JWTs and check permissions. Built on Axowl's v22 Snapshot Architecture (yes/no permission system).

Install

dotnet add package Axowl.Sdk.Identity.Client

Quickstart

using Axowl.Sdk.Identity.Abstractions.Contracts;
using Axowl.Sdk.Identity.Client;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAxowlIdentity(opts =>
{
    opts.OrganizationSlug = "bullmark";              // your Axowl Org slug
    opts.Audience         = "app_bullmark_main";     // your ApplicationKey
    opts.ApiKey           = builder.Configuration["Axowl:ApiKey"]!;
    opts.Transport        = TransportMode.GrpcWithFallback;
    // Endpoints default to testapi/testgrpc.axowl.com — the environment Axowl serves today.
    // Set these only to point somewhere else:
    // opts.Authority         = "https://testapi.axowl.com";
    // opts.ServerAddress     = "https://testgrpc.axowl.com";
    // opts.RestServerAddress = "https://testapi.axowl.com";
});

builder.Services.AddAuthorization();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

// Protected endpoint — JWT verified via Axowl's JWKS, no server roundtrip
app.MapGet("/wallet", (HttpContext ctx) =>
{
    var p = ctx.User.GetAxowlPrincipal();
    return Results.Ok(new { user = p?.Email, org = p?.OrganizationId });
}).RequireAuthorization();

// Permission-gated endpoint — JWT claims fast-path
app.MapGet("/admin/billing",
    [RequirePermission("billing.admin")]
    () => Results.Ok("Sensitive billing data"));

// Server-authoritative check — for cases where JWT claims may be stale
app.MapPost("/admin/wipe",
    [RequirePermission("system.admin", ServerCheck = true)]
    () => Results.Ok("Wiped"));

app.Run();

Two verification modes

Direct API client

For non-attribute use (programmatic checks, background jobs, audit):

public class WalletService
{
    private readonly IAxowlIdentityClient _identity;
    public WalletService(IAxowlIdentityClient identity) => _identity = identity;

    public async Task<bool> CanUserWithdrawAsync(string jwtToken, CancellationToken ct)
    {
        var result = await _identity.CheckPermissionAsync(jwtToken, "wallet.withdraw", ct);
        return result.Granted;
    }

    public async Task<AxowlPrincipal?> ResolveAsync(string jwtToken, CancellationToken ct)
    {
        var introspect = await _identity.IntrospectAsync(jwtToken, ct);
        return introspect.Active ? introspect.Principal : null;
    }
}

Permission scope format

Mirrors Axowl's v22 ResolvedScope:

Variables (:k=v) are matched as part of the resolved string. SDK's client-side wildcard handles prefix matching; full variable-aware evaluation requires ServerCheck = true.

Configuration reference

public sealed class AxowlIdentityClientOptions
{
    // JwtBearer / JWKS — required
    public string Authority         { get; set; } = "https://testapi.axowl.com";
    public string OrganizationSlug  { get; set; } = "";   // required
    public string Audience          { get; set; } = "";   // required (your ApplicationKey)
    public string Issuer            { get; set; } = "axowl";

    // gRPC / REST IdentityService — optional, for server-side checks
    public string ServerAddress     { get; set; } = "https://testgrpc.axowl.com";
    public string RestServerAddress { get; set; } = "https://testapi.axowl.com";
    public string ApiKey            { get; set; } = "";   // required when using Introspect / CheckPermission
    public TransportMode Transport  { get; set; } = TransportMode.Grpc;
}

Related

• Axowl.Sdk.Integrity.Client — hash chain / tamper detect
• Architecture: docs/2026-05-26-axowl-sdk-api-surface.md