1. Client sends credentials: POST /auth/login { email, password }
2. Server validates, creates JWT, sends it back
3. Client stores token (memory or localStorage)
4. Client sends token in every request: Authorization: Bearer 
5. Server validates token on each request — no database lookup needed

eyJhbGciOiJIUzI1NiJ9  .  eyJzdWIiOiIxMjMifQ  .  signature
   Header (base64)            Payload (base64)      Signature

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

// JWT settings from appsettings.json
var jwtKey    = builder.Configuration["Jwt:Key"]!;
var jwtIssuer = builder.Configuration["Jwt:Issuer"]!;

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer           = true,
            ValidateAudience         = true,
            ValidateLifetime         = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer              = jwtIssuer,
            ValidAudience            = jwtIssuer,
            IssuerSigningKey         = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
            ClockSkew                = TimeSpan.Zero  // no grace period — token expires exactly at exp
        };
    });

builder.Services.AddAuthorization();
var app = builder.Build();

app.UseAuthentication();  // must come before UseAuthorization
app.UseAuthorization();

{
  "Jwt": {
    "Key": "your-secret-key-minimum-32-characters-long",
    "Issuer": "https://yourapp.com"
  }
}

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;
using System.Text;

public class TokenService
{
    private readonly IConfiguration _config;

    public TokenService(IConfiguration config) => _config = config;

    public string CreateToken(int userId, string email, string role)
    {
        var key = new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes(_config["Jwt:Key"]!));

        var claims = new[]
        {
            new Claim(JwtRegisteredClaimNames.Sub, userId.ToString()),
            new Claim(JwtRegisteredClaimNames.Email, email),
            new Claim(ClaimTypes.Role, role),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
        };

        var token = new JwtSecurityToken(
            issuer:   _config["Jwt:Issuer"],
            audience: _config["Jwt:Issuer"],
            claims:   claims,
            expires:  DateTime.UtcNow.AddHours(1),
            signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256)
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

app.MapPost("/auth/login", async (LoginRequest req, TokenService tokens, IUserService users) =>
{
    var user = await users.ValidateAsync(req.Email, req.Password);
    if (user is null) return Results.Unauthorized();

    var token = tokens.CreateToken(user.Id, user.Email, user.Role);
    return Results.Ok(new { token, expiresIn = 3600 });
});

// Protected endpoint
app.MapGet("/me", (HttpContext ctx) =>
{
    var userId = ctx.User.FindFirstValue(ClaimTypes.NameIdentifier);
    var email  = ctx.User.FindFirstValue(ClaimTypes.Email);
    return Results.Ok(new { userId, email });
}).RequireAuthorization();

// Role-protected endpoint
app.MapDelete("/admin/users/{id}", (int id) => Results.Ok())
    .RequireAuthorization(policy => policy.RequireRole("Admin"));

record LoginRequest(string Email, string Password);

[ApiController]
[Authorize]
[Route("api/[controller]")]
public class ProfileController : ControllerBase
{
    [HttpGet]
    public IActionResult Get()
    {
        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
        var email  = User.FindFirstValue(ClaimTypes.Email);
        var role   = User.FindFirstValue(ClaimTypes.Role);

        return Ok(new { UserId = userId, Email = email, Role = role });
    }
}

✓ Secret key is at least 32 characters — store in Azure Key Vault or env var
✓ Set ClockSkew = TimeSpan.Zero — predictable expiry
✓ Use short-lived access tokens (15–60 min) + refresh tokens
✓ Include jti (JWT ID) claim for token revocation
✓ Validate audience — prevents token reuse across services
✓ Use HTTPS only — JWTs in plaintext are readable
✓ Don't store sensitive data in the payload — it's base64, not encrypted