// For use in C# backend code
public class ApiKeyClient
{
    private readonly string _tenantBaseUrl;
    private readonly HttpClient _httpClient;

    public ApiKeyClient(string host, string tenantId, string apiKey)
    {
        _tenantBaseUrl = $"{host}/tenant/{tenantId}";

        _httpClient = new HttpClient();
        _httpClient.DefaultRequestHeaders.Add("X-API-Key", apiKey);
    }

    public async Task<HttpResponseMessage> GetAsync(string endpoint)
    {
        var url = $"{_tenantBaseUrl}{endpoint}";
        return await _httpClient.GetAsync(url);
    }
}

# For use in Python backend code
class ApiKeyClient:
    def __init__(self, host, tenant_id, api_key):
        self.tenant_base_url = f"{host}/tenant/{tenant_id}"
        self.headers = {
            "X-API-Key": api_key,
            "Content-Type": "application/json"
        }

    def get(self, endpoint):
        url = f"{self.tenant_base_url}{endpoint}"
        return requests.get(url, headers=self.headers)

// C# example using Microsoft.IdentityModel.Tokens
using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Tokens;
using Microsoft.IdentityModel.Protocols;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using System.Security.Claims;

public class JwtValidationService
{
    private readonly string _baseUrl;
    private readonly string _tenantId;
    private readonly ConfigurationManager<OpenIdConnectConfiguration> _configurationManager;

    public JwtValidationService(string baseUrl, string tenantId)
    {
        _baseUrl = $"{baseUrl}/tenant/{tenantId}";
        _tenantId = tenantId;
        
        // Create configuration manager for JWKS endpoint
        _configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
            $"{_baseUrl}/v2.0/Auth/.well-known/openid-configuration",
            new OpenIdConnectConfigurationRetriever(),
            new HttpDocumentRetriever()
        );
    }

    public async Task<ClaimsPrincipal> ValidateTokenAsync(string token)
    {
        // Get configuration (includes signing keys from JWKS)
        var configuration = await _configurationManager.GetConfigurationAsync(CancellationToken.None);
        
        var tokenHandler = new JwtSecurityTokenHandler();
        var validationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKeys = configuration.SigningKeys,
            
            ValidateIssuer = true,
            ValidIssuer = $"{_baseUrl}/v2.0/Auth",
            
            ValidateAudience = true,
            ValidAudience = _tenantId,
            
            ValidateLifetime = true,
            ClockSkew = TimeSpan.Zero // No clock skew tolerance
        };

        // Validate token
        var principal = tokenHandler.ValidateToken(token, validationParameters, out SecurityToken validatedToken);
        
        return principal;
    }
}

// ASP.NET Core middleware usage
public class JwtValidationMiddleware
{
    private readonly RequestDelegate _next;
    private readonly JwtValidationService _jwtValidation;

    public JwtValidationMiddleware(RequestDelegate next, JwtValidationService jwtValidation)
    {
        _next = next;
        _jwtValidation = jwtValidation;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        var authHeader = context.Request.Headers["Authorization"].FirstOrDefault();
        
        if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Bearer "))
        {
            context.Response.StatusCode = 401;
            await context.Response.WriteAsync("Missing or invalid authorization header");
            return;
        }

        var token = authHeader.Substring(7); // Remove "Bearer " prefix

        try
        {
            var principal = await _jwtValidation.ValidateTokenAsync(token);
            context.User = principal; // Set validated user
            await _next(context);
        }
        catch (Exception ex)
        {
            context.Response.StatusCode = 401;
            await context.Response.WriteAsync($"Token validation failed: {ex.Message}");
        }
    }
}

# Python example using PyJWT and cryptography
import jwt
from jwt import PyJWKClient
from functools import wraps
from flask import Flask, request, jsonify

BASE_URL = 'https://auth.agglestone.com/tenant/{tenantId}'
TENANT_ID = 'your-tenant-id'

# Create JWKS client
jwks_client = PyJWKClient(f'{BASE_URL}/.well-known/jwks.json')

def validate_token(token):
    """Validate JWT token and return decoded claims"""
    try:
        # Get signing key from JWKS
        signing_key = jwks_client.get_signing_key_from_jwt(token)
        
        # Decode and validate token
        decoded_token = jwt.decode(
            token,
            signing_key.key,
            algorithms=['RS256'],
            audience=TENANT_ID,
            issuer=f'{BASE_URL}/v2.0/Auth',
            options={
                'verify_signature': True,
                'verify_exp': True,
                'verify_aud': True,
                'verify_iss': True
            }
        )
        
        return decoded_token
    except jwt.ExpiredSignatureError:
        raise ValueError('Token has expired')
    except jwt.InvalidAudienceError:
        raise ValueError('Invalid token audience')
    except jwt.InvalidIssuerError:
        raise ValueError('Invalid token issuer')
    except jwt.InvalidSignatureError:
        raise ValueError('Invalid token signature')
    except Exception as e:
        raise ValueError(f'Token validation failed: {str(e)}')

# Flask middleware/decorator
def token_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        auth_header = request.headers.get('Authorization')
        
        if not auth_header or not auth_header.startswith('Bearer '):
            return jsonify({'error': 'Missing or invalid authorization header'}), 401
        
        token = auth_header[7:]  # Remove 'Bearer ' prefix
        
        try:
            claims = validate_token(token)
            # Attach claims to request context
            request.user = claims
        except ValueError as e:
            return jsonify({'error': str(e)}), 401
        
        return f(*args, **kwargs)
    return decorated