Never trust.
Every connection.
Explore how B5 Secure sits between every caller and your .NET code. Choose a connection. Follow it through the pipeline. Inspect the real request, decision and evidence shapes — quoted from the published developer tools, not invented.
Connections
- Identity & authentication — HMAC, Service-HMAC, AuthCookie and Service-Key: one pipeline for browsers, services and callbacks. Authenticate a signed request: Sign → Pipeline → Decide → Evidence
- .NET runtimes — ASP.NET Core, MVC, Web API, .NET Framework and ServiceStack — the pipeline attaches with a registration and an attribute. Protect an endpoint: Register → Declare → Run → Evidence
- Native & browser clients — iOS, Android and Chrome extensions as public clients: device keys, PKCE, attestation — never an embedded tenant secret. Bind a device: Generate → Prove → Verify → Authorize
- Partners & on-premises — Delegated partner access and outbound-only connectors to private APIs — without moving authoritative truth outside B5. Delegate without delegating truth: Sign → Check → Connect → Evidence
- Webhooks & events — Signed, replay-safe, idempotent delivery for authorization, session, credential, policy, entitlement and evidence changes. Deliver a signed event: Emit → Sign → Verify → Operate
- Evidence & SIEM — OCSF authority decisions, hash-chained and signed, landing in Sentinel, Splunk, Google SecOps and Security Lake — and verifiable without B5. From decision to examiner: Record → Chain → Ship → Verify
The interactive explorer needs JavaScript. This index lists the same six connections and their flows.
What every connection shares
The properties the pipeline guarantees, whichever caller is on the other end.
Absence of evidence is absence of access, at every stage.
Three decision points — Request, Access, Delivery — and every default is closed.
Authority ends at the exact time of change; in-flight work fails by default.
Signed, hash-chained records a third party verifies without trusting B5.
A clear view.
A separate environment.
This page walks the connections published across B5 Secure’s guides, developer tools and evidence format through the pipeline. Every header, code excerpt and decision record is quoted from published material; every flow runs in your browser.
Flows are illustrative. Production endpoints, credentials, native attestation, cloud integrations and release certification are environment-specific. Capabilities marked Preview or Q4 2026 carry their status from the Product Truth Registry.
Then make the first real call
Test Mode is a sealed rehearsal room: placeholder credentials, a tenant-issued base URL, and every failure path exercised before staging.