The SignalWire .NET SDK provides a unified security configuration system with secure defaults for HTTPS, basic authentication, and security headers.

using SignalWire.Agent;
using System.Collections.Generic;
// Shared context for the fragments below: a constructed `agent`.
AgentBase agent = new AgentBase(new AgentOptions { Name = "a", Route = "/a" });

export SWML_SSL_ENABLED=true
export SWML_SSL_CERT_PATH=/path/to/cert.pem
export SWML_SSL_KEY_PATH=/path/to/key.pem
export SWML_DOMAIN=yourdomain.com

Basic auth is enabled by default with auto-generated credentials:

export SWML_BASIC_AUTH_USER=myusername
export SWML_BASIC_AUTH_PASSWORD=mysecurepassword

When your SignalWire endpoint presents a certificate issued by a private or self-signed CA (a dedicated space, an on-prem deployment, or a TLS-terminating proxy), point the client at the issuing CA bundle with these env vars. Each names a PEM/DER file whose CA is added as an additional trust anchor: a chain that already validates under the OS trust store is accepted unchanged, and a chain whose only defect is an untrusted root is re-validated against the supplied CA. Any other TLS defect (hostname mismatch, expired/unavailable cert) still fails — setting these does not disable verification. Unset → the OS trust store alone is used. These are the .NET analogue of pointing Python's REST session at a verify CA bundle and building the RELAY SSL context from a cafile.

When no credentials are provided, the SDK generates secure credentials automatically:

using System;
using SignalWire.Agent;

var agent = new AgentBase(new AgentOptions { Name = "my-agent" });

// Credentials are auto-generated; GetBasicAuthCredentials() returns the resolved pair
var (user, password) = agent.GetBasicAuthCredentials();
Console.WriteLine($"User: {user}");
Console.WriteLine($"Pass: {password}");

using System;
using SignalWire.Agent;

var agent = new AgentBase(new AgentOptions
{
    Name              = "my-agent",
    BasicAuthUser     = "custom-user",
    BasicAuthPassword = "custom-password-123",
});

SWAIG webhook URLs automatically include basic auth credentials:

http://signalwire:abc123@localhost:3000/agent/swaig

This ensures that only SignalWire can call your SWAIG endpoints.

All responses include security headers:

When behind a reverse proxy, set the proxy URL manually:

agent.ManualSetProxyUrl("https://myagent.example.com");

This ensures SWAIG webhook URLs and post-prompt URLs use the correct public address.

1. Enable HTTPS via SWML_SSL_ENABLED=true
2. Set explicit basic auth credentials (do not rely on auto-generated in production)
3. Configure a reverse proxy (nginx, Caddy, etc.) for TLS termination
4. Set SWML_DOMAIN to your public domain
5. Use ManualSetProxyUrl() when behind a load balancer
6. Store credentials in environment variables, not in source code