Enterprise-grade .NET SDKs for Swish & BankID
Security correctness, predictable integrations, and fewer mistakes — deterministic SDKs designed for high-stakes Swedish payment and identity flows.
$ dotnet add package NordAPI.Swish$ dotnet add package NordAPI.BankIDProducts
Two SDKs, one security-first architecture. Choose the integration you need.
NordAPI.Swish
Available.NET 8 LTSPayment SDK for the Swish ecosystem with mTLS, idempotent operations, and replay-resistant webhook verification.
mTLS by Default
mTLS is required by default. If no client certificate can be resolved, the SDK throws SwishConfigurationException. No silent fallback.
Webhook Verification
HMAC Base64 signature verification for webhook payloads. Optional internal signing layer for edge/test tooling.
Replay Protection
Timestamp validation in seconds and nonce-based replay protection. Fail-closed: invalid or expired requests are rejected.
Idempotent Retries
Idempotency-Key is generated once per operation and reused across retries. Prevents duplicate charges during transient failures.
API Stability
SemVer discipline and guardrails that keep the public surface predictable. Breaking changes are treated as deliberate releases.
Why NordAPI
Enterprise-grade SDKs for teams that cannot afford ambiguity
NordAPI is designed for production trust: security correctness, deterministic behavior, and implementation patterns that hold up in real operational environments.
Security-first by design
Spec-locked behavior, fail-closed defaults, and explicit transport security reduce ambiguity in high-trust payment and identity integrations.
Deterministic integration flows
NordAPI is built for predictable runtime behavior under retries, misconfiguration, and operational edge cases — not just happy-path demos.
Your certificates stay with you
No proxy model. No credential handoff. Sensitive material remains inside your own environment and operational boundary.
Built for enterprise trust
Clear contracts, production-oriented defaults, and documentation that aligns with implementation help teams move faster without lowering the bar.
Integration Architecture
Deterministic transport and fail-closed security for every request.
Zero-proxy architecture
Direct mTLS connections from your infrastructure — no gateway, no proxy, no call-home licensing.
Engineering for financial integrity
NordAPI is designed for high-trust payment and identity integrations. We provide deterministic guarantees that reduce common integration risk without introducing a proxy layer into the critical path.
Data Sovereignty
Certificates and secrets remain inside your infrastructure. No third-party relays in the transaction path.
Deterministic Risk Mitigation
Fail-closed defaults prevent operations under insecure or misconfigured states.
Protocol Integrity
Hardened verification with canonical byte matching, HMAC-SHA256, and replay protection.
Transaction Consistency
Idempotency discipline helps ensure stable payment behavior during retries and transient faults.
Transparent pricing for high-stakes integrations
Swish is free in production. BankID includes unlimited sandbox and dev access with no time-limited trial. Go live when your bank agreement is ready.
Community
- NordAPI.Swish is free in production
- Public NuGet package
- Docs and samples
- GitHub community support
Pro
Recommended- Unlimited sandbox and dev access
- Production unlocks appapi2.bankid.com
- Offline gate, no call-home, fail closed
- No proxy and no credential middlemen
Enterprise
- SLA and onboarding
- Security review support
- Contract and invoicing
- Custom terms available
FAQ
Security contact security@nordapi.com