#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Features\.Nonces Namespace

| Classes | |
| :--- | :--- |
| [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') | Base configuration class for the generic stateless\-nonce service\. Each feature that needs server\-issued, time\-bounded opaque tokens \(DPoP\-Nonce per RFC 9449 §8 / §9 is the current consumer; future candidates include state\-parameter validation and challenge\-response patterns\) defines its own subclass — see [DPoPNonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') — and adds its own slot under [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')\. This base governs only the primitive's own concerns: issuance window and secret\-rotation cadence\. Feature\-specific policy \(e\.g\. which DPoP endpoints require a nonce\) lives on the corresponding subclass\. |
| [RollingHmacNonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService') | HMAC\-SHA256 backed implementation of [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')\. Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])` where `secret` is rotated on a configurable cadence and shared across server instances via [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), keyed by time bucket\. |

| Interfaces | |
| :--- | :--- |
| [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService') | Issues and validates server\-issued opaque, time\-bounded nonces\. The current consumer is DPoP\-Nonce per RFC 9449 §8 / §9 — the server returns a nonce via the `DPoP-Nonce` response header and the client echoes it back in the `nonce` claim of a subsequent DPoP proof to prove freshness — but the primitive is intentionally generic: any future feature needing challenge\-response freshness checks can resolve the same service\. |

| Enums | |
| :--- | :--- |
| [NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure') | Reasons a server\-issued nonce can fail validation\. The categories are for log filters and metrics — at the protocol layer DPoP\-Nonce flows surface every failure as the same RFC 9449 §8 `use_dpop_nonce` error with a freshly issued nonce in the response header, regardless of the underlying reason\. |