Skip to main content
.NET integrates through the Execution Fabric REST API. Register a reusable HttpClient in your trusted backend and keep the Praxa key out of WebAssembly, desktop, and mobile bundles.

Prerequisites

Before you begin, prepare:
  • a trusted server runtime and application authentication boundary;
  • a disposable personal workspace Praxa key with only the tutorial’s required scopes;
  • synthetic input plus a persisted application request ID for replay tests;
  • a fake upstream for unit tests and a non-production environment for canaries;
  • an acceptance assertion that proves the ASP.NET boundary admits and reconciles one task through the shared HttpClient.

1. Register the client

Program.cs

2. Implement the typed client

PraxaClient.cs
The application principal supplies userId; the untrusted request body does not. Store the key in a protected configuration provider such as your cloud secret manager or environment, not in appsettings.json committed to Git.

3. Expose a bounded endpoint

In ASP.NET Core, authenticate and validate before invoking the client:
Add Cache-Control: no-store and your application rate limit. Map upstream errors to a safe problem document rather than exposing the response body.

4. Test with a fake handler

Create a custom HttpMessageHandler or use your preferred HTTP test library. Assert:
  • invalid input makes no outbound request;
  • authorization and idempotency headers are correct;
  • the same user/request pair produces the same key;
  • cancellation reaches SendAsync;
  • 401, 403, 409, and 429 map to distinct safe errors;
  • no secret appears in logs or response JSON.

5. Verify live behavior

Use a disposable least-privilege key, submit one task, read it to terminal, replay the exact request, then revoke the key. An Accepted response proves admission only.

Troubleshooting

Best practices

  • Use IHttpClientFactory and explicit timeouts.
  • Forward cancellation tokens.
  • Keep typed authority outside client-controlled DTOs.
  • Bound JSON input and response size.
  • Record safe status/problem metadata only.
  • Test exact retry and cross-tenant refusal before production.

HttpClient guidelines

Review connection pooling, lifetime, DNS, retry, and client-factory guidance in the official .NET documentation.

Optimize for production

  • Reuse one configured HTTP or SDK client per process and bound concurrent upstream work.
  • Prefer durable admission plus asynchronous readback over holding application requests open.
  • Cache only non-sensitive, tenant-scoped reads within their documented freshness window.
  • Measure p50/p95 latency, admission-to-terminal time, retries, conflicts, and connection reuse before tuning.
Optimize only after the correctness and isolation matrix passes. Lower latency or cost is not an improvement if verified outcomes, authority checks, or recovery rates regress.

Cleanup and next steps

  1. Revoke the disposable Praxa key and require a later request to fail.
  2. Remove synthetic application records and any temporary environment files.
  3. Cancel or archive unresolved test runs according to the application policy.
  4. Retain only redacted request, run, and verification identifiers needed for the test record.
After cleanup, run the shared integration test matrix and record any environment-specific check that remains pending.

Frequently asked questions

What proves this tutorial works?

The minimum observable result is that the ASP.NET boundary admits and reconciles one task through the shared HttpClient. A compile, package import, mocked response, or initial admission alone does not prove the complete workflow.

Can a browser, mobile app, or model prompt hold the credential?

No. Browser and mobile bundles are inspectable. Keep the Praxa credential in the trusted application backend.

How should an ambiguous mutation be retried?

Persist the exact logical input and idempotency key before the first attempt. Reconcile through authoritative readback or replay the exact request with that same key before creating new work.

What should we monitor after release?

Monitor application auth failures, upstream status/code, latency, retries, replay conflicts, and terminal run outcomes. Alert on authorization bypass, cross-tenant disclosure, repeated conflicts, or cleanup failure.
Last modified on August 14, 2026