When will you use this?

Use Web API when a website, mobile app, or React frontend needs JSON from your server.

• Mobile apps and React frontends call your ASP.NET Core API over HTTP with JSON.
• JWT tokens prove who the user is on every protected API request.

Real-world: Practo-style clinic API

The Healthcare team building Practo-style clinic API uses JWT Authentication to return token on login; React sends it on every API call. patients and doctors never see the C# code — they just get a fast, reliable appointment booking and slots.

Production-style code

[HttpPost("login")]
public async Task<IActionResult> Login(LoginDto dto)
{
    var user = await _users.ValidateAsync(dto.Email, dto.Password);
    if (user is null) return Unauthorized();

    var token = _jwt.CreateToken(user);
    return Ok(new { token });
}

What happens in production: In Practo-style clinic API, getting JWT Authentication right means patients and doctors trust the appointment booking and slots every day.

Lesson example (start here)

Copy this smaller example first. Once it works, compare it with the real-world code above.

[HttpPost("login")]
public async Task<IActionResult> Login(LoginDto dto)
{
    var user = await _users.FindByEmailAsync(dto.Email);
    if (user is null || !await _users.CheckPasswordAsync(user, dto.Password))
        return Unauthorized();

    var token = _jwtService.CreateToken(user);
    return Ok(new { token });
}

Line-by-line walkthrough

How it works (big picture)

• Validate email and password.
• If good, create a signed JWT with user id and roles.
• Client stores token and sends Bearer token on later calls.

Do this on your computer

1. Add JWT packages and configure in Program.cs.
2. Create login endpoint.
3. Add [Authorize] to a protected GET.
4. Test with Postman: login, then call protected route with token.
5. Read the real-world section and name which part of the app uses this topic.
6. Run the example locally with dotnet run and confirm the same behavior.
7. Change one value in the example (route, text, or connection string) and predict what will happen before you save.

Experiments — try changing this

• Change a string or route in the example and save — watch the browser or Swagger response update.
• Break the code on purpose (remove a semicolon), read the error message, then fix it.
• Use dotnet watch run while editing JWT Authentication — the app restarts on save.

Remember

Login returns JWT. Client sends Authorization: Bearer <token>. Server validates signature on each request.

Common questions