Why should you care?

Mobile and SPA apps use JWT for stateless auth. It scales across multiple API servers behind a load balancer.

See it live — copy this example

Create a Web API (dotnet new webapi), paste the example, run dotnet run, test in Swagger.

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(o =>
    {
        o.TokenValidationParameters = new TokenValidationParameters
        {
            ValidIssuer = config["Jwt:Issuer"],
            ValidAudience = config["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(config["Jwt:Key"]!))
        };
    });

Run Example »

Edit the code and click Run — like W3Schools Try it Yourself.

What happened?

• AddAuthentication before AddAuthorization.
• [Authorize] blocks anonymous calls with 401.
• Store JWT key in appsettings or Azure Key Vault — not in git.

Try it yourself

1. Add JWT NuGet packages.
2. Configure JwtBearer in Program.cs.
3. Protect one GET endpoint with [Authorize] and test 401 without token.
4. Change a route URL or DTO property and save — test again in Swagger or curl.
5. Return the wrong status code on purpose (404 instead of 200) and see what the client shows.

Remember

JWT in Authorization Bearer header. Validate issuer, audience, signature. [Authorize] on protected routes.