What: Authorization framework to obtain access tokens for APIs (many flows).
Why: Standard way for third-party apps and services to gain scoped access.
Code (illustration: validate token - server trusts an identity provider)
// On resource server: accept tokens issued by an OAuth2 auth server (Authority)
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.Authority = "https://auth.example.com"; // OAuth2 Authorization Server
options.Audience = "myapi";
options.RequireHttpsMetadata = true;
});
builder.Services.AddAuthorization();