Toolbox

Developer Tools

This page is the component shelf. Every item below has a concrete file or destination rather than a decorative label.

Downloadable tools

Postman collectionTest-mode request collection.Open →Postman environmentEnvironment variable template.Open →.NET Quick StartReference .NET 10 console client.Open →Bash clientSigned request shell template.Open →PowerShell clientSigned request PowerShell template.Open →Webhook verifierReference fixed-time webhook signature verifier.Open →Test settingsConfiguration template.Open →Promotion checklistEvidence checklist for staging and production review.Open →

Documentation surfaces

Build hubDeveloper entry point.Open →Guide indexPlatform and deployment guides.Open →Use casesIntegration pattern catalog.Open →Test ModeSimulation and failure-path workflow.Open →Quick StartFirst protected request.Open →

Planned connected services

API referencePublish generated OpenAPI only from compiled endpoints.Open →Enterprise Developer PortalTenant-scoped control plane for developers, projects, apps, credentials, webhooks, and deployments.Open →Status and trust centerOperational status, trust evidence, advisories, and release posture.Open →Docs MCP and AI skillsMachine-readable docs and governed developer-assistance endpoints.Open →

Implementation steps

Download the Postman collection and environment.

Run the Quick Start with test-only credentials.

Adopt the platform-specific sample without embedding persistent bearer tokens or tenant signing secrets.

Track every promotion requirement in the supplied checklist.

Control details

Planned Api Reference

The API reference should be generated from build-certified endpoints. The current roadmap contract must not be presented as generally available.

Planned Developer Portal

The reference portal model exists, but durable tenant persistence, federation, HSM-backed credentials, approvals, and production telemetry remain release work.

Planned Status

A production status and trust surface requires live monitoring, incident workflow, evidence ownership, and publication governance.

Planned Ai Tools

Docs MCP and AI skills should expose approved documentation and metadata only, with tenant isolation, rate limits, audit, and prompt-injection defenses.

Developer kit

Download the working components

These are source-level reference assets. They do not contain production endpoints, production credentials, or a claim that a roadmap API is generally available.

ZIPComplete developer kitAll samples, configuration, Postman assets, and checklists.Download ↓C#.NET 10 quick startSDK-style .NET 10 project.Download ↓C#Request signerCanonical HMAC-SHA-256 request signing.Download ↓C#First protected callRunnable console client.Download ↓C#Webhook verifierFreshness and constant-time signature verification.Download ↓JSONPostman collectionHealth, decision, evidence, and webhook requests.Download ↓JSONPostman environmentTest-only variables.Download ↓PS1PowerShell clientWindows and LocalWP-friendly signed request.Download ↓SHBash clientmacOS, Linux, and WSL signed request.Download ↓SwiftiOS PKCE samplePKCE and device-proof starting point.Download ↓KotlinAndroid device proofAndroid Keystore signing sample.Download ↓MV3Chrome extension sampleManifest V3 and service-worker sample.Download ↓YAMLOpenAPI starterReference-only API contract.Download ↓MDPromotion checklistSecurity, evidence, and release gates.Download ↓

First request

What the signer protects

Canonical signed request

var signed = B5RequestSigner.Sign(
    HttpMethod.Post,
    new Uri($"{baseUrl}/v1/trust/decisions"),
    body,
    tenantId,
    applicationId,
    keyId,
    secret,
    DateTimeOffset.UtcNow);

request.Headers.Add("X-B5-Timestamp", signed.Timestamp);
request.Headers.Add("X-B5-Nonce", signed.Nonce);
request.Headers.Add("X-B5-Content-SHA256", signed.ContentSha256);
request.Headers.Authorization =
    new AuthenticationHeaderValue("B5-HMAC-SHA256", signed.SignatureBase64);

Signed fields

Algorithm version, method, request target, timestamp, nonce, content digest, tenant ID, and application ID.

Receiver checks

Key status, allowed algorithm, freshness, audience, canonical form, signature, replay state, authorization, and evidence emission.

Developer Relations

Talk to a human.

Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.

Contact Developer Relations Request a demo