TrueLayer.Signing

C# library to produce & verify TrueLayer API requests signatures.

using TrueLayer.Signing; // `Tl-Signature` value to send with the request. var tlSignature = Signer.SignWithPem(kid, privateKey) .Method("POST") .Path(path) .Header("Idempotency-Key", idempotency_key) .Body(body) .Sign();

See full example.

Verifying webhooks

The VerifyWithJwks function may be used to verify webhook Tl-Signature header signatures.

// `jku` field is included in webhook signatures var jku = Verifier.ExtractJku(webhookSignature); // check `jku` is an allowed TrueLayer url & fetch jwks JSON (not provided by this lib) EnsureJkuAllowed(jku); var jwks = FetchJwks(jku); // jwks may be used directly to verify a signature // a SignatureException is thrown is verification fails Verifier.VerifyWithJwks(jwks) .Method("POST") .Path(path) .Headers(allWebhookHeaders) .Body(body) .Verify(webhookSignature);

See webhook server example.

Compatibility

.NET Standard 2.0 is supported however .NET Framework 4.6.x is not as it's missing required cryptography libraries. For .NET Framework use 4.7.x or higher.