#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.Signing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing 'Abblix\.Jwt\.Signing')

## IDataSigner Interface

A signing backend that owns a slice of the server's signing keys and produces JWS signature bytes for the
keys it owns\. Backends compose as peers behind [Abblix\.Jwt\.Signing\.CompositeSigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.signing.compositesigner 'Abblix\.Jwt\.Signing\.CompositeSigner'), which asks each in turn
whether it owns the key \([CanSign\(JsonWebKey\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey) 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)')\) and routes to the first that does: the in\-process
[Abblix\.Jwt\.Signing\.LocalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.signing.localkeysigner 'Abblix\.Jwt\.Signing\.LocalKeySigner') owns keys that carry private material, an external custodian backend
\([Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeysigner 'Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner')\) owns the public\-only keys whose `kid` is its handle\. This is the
byte\-level counterpart of the token\-level [IJsonWebTokenSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenSigner 'Abblix\.Jwt\.IJsonWebTokenSigner'): it works with bytes, not a
whole token, so an HSM/KMS/vault integration is one more backend and never touches JWS framing\.

```csharp
public interface IDataSigner
```
### Methods

## IDataSigner\.CanSign\(JsonWebKey\) Method {#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey)}

Reports whether this signer owns [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)\.key') and can therefore sign with it\. Ownership is a
property of the key, not of the algorithm: the in\-process backend owns keys that carry private material,
an external custodian backend owns the public\-only keys whose `kid` is one of its handles\.

```csharp
bool CanSign(Abblix.Jwt.JsonWebKey key);
```
#### Parameters

###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey).key}

The signing key the composite is about to route\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
`true` if this signer can sign with [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)\.key'); otherwise `false`\.

## IDataSigner\.SignAsync\(JsonWebKey, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken)}

Produces the signature bytes for [data](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).data 'Abblix\.Jwt\.Signing\.IDataSigner\.SignAsync\(Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.data') under [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm 'Abblix\.Jwt\.Signing\.IDataSigner\.SignAsync\(Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.algorithm') using
[key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).key 'Abblix\.Jwt\.Signing\.IDataSigner\.SignAsync\(Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.key'), in the JWS wire format for the algorithm\.

```csharp
System.Threading.Tasks.Task<byte[]> SignAsync(Abblix.Jwt.JsonWebKey key, string algorithm, byte[] data, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).key}

The signing key\. Its `kid` is the custodian's handle when it is external\.

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm}

The JWS algorithm identifier \(e\.g\. RS256, ES256\) the signature must use\.

###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).data}

The signing input bytes, BASE64URL\(header\) \+ '\.' \+ BASE64URL\(payload\)\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).cancellationToken}

Cancels the signing operation, including a custodian round\-trip\.

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
The raw signature bytes in JWS wire format for the algorithm\.