NexusShield class

Nexus Shield — proves to your backend (and to Nexus) that a request comes from your genuine app on a genuine device.

await Nexus.init(const NexusConfig(apiKey: 'nxs_…', shieldEnabled: true));

// Any request to YOUR backend:
final headers = await Nexus.instance.shield.headers(method: 'POST', url: uri);
await http.post(uri, headers: {...headers, 'content-type': 'application/json'}, body: body);

// …or wrap a client once and forget about it:
final client = NexusShieldClient(http.Client());

On Android the device key is generated in StrongBox/TEE and certified by Google's hardware attestation; Play Integrity is added when the app is configured for it in the console. On iOS the key lives in the Secure Enclave and App Attest vouches for it. Tokens refresh automatically before they expire. Failures never throw into your code: headers returns {} and your backend's policy decides (monitor vs enforce).

Constructors

NexusShield(NexusHttp _http, NexusConfig _config)

Properties

appId ↔ String?

The package / bundle id, from native device info (set by Nexus at init).

getter/setter pair

current → NexusShieldToken?

The current token (null until the first successful exchange).

no setter

hashCode → int

The hash code for this object.

no setter, inherited

onRefused ↔ void Function(String failure)?

Called when an exchange is refused, with the backend's failure code.

getter/setter pair

onToken ↔ void Function(NexusShieldToken token)?

Called whenever a new token is issued (score/level changes are visible here).

getter/setter pair

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

dispose() → void

headers({required String method, required Uri url, List<int>? body}) → Future<Map<String, String>>

Headers proving THIS request comes from this device: X-Nexus-Shield (the token) and DPoP (a single-use proof for exactly method + url). Pass body to also bind the proof to the payload. Returns {} when no token can be had — never throws.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

reset() → Future<void>

Forget the device key and token (e.g. on sign-out of a shared device). The next call creates and attests a brand-new key.

start() → Future<void>

Warm up: restore a cached token and obtain one if needed (non-blocking).

token({bool forceRefresh = false}) → Future<NexusShieldToken?>

A valid token, exchanging (or refreshing) one if needed. Concurrent callers share one exchange. Null when one can't be obtained right now.

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited