How to Implement JWT Authentication in ASP.NET Core Web API?

To implement JWT authentication in ASP.NET Core Web API, you need to configure three main things:

1. JWT authentication setup

2. Token generation

3. Securing endpoints

1. Install Required Package

First, install the JWT Bearer package:

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

2. Configure JWT in Program.cs

Simply calling AddAuthentication() is not enough. You must configure JWT properly:

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,

        ValidIssuer = "yourIssuer",
        ValidAudience = "yourAudience",
        IssuerSigningKey = new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes("YourSecretKey12345"))
    };
});

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication(); // must come before UseAuthorization
app.UseAuthorization();

app.MapControllers();

app.Run();

3. Generate JWT Token

Create a helper/service to generate the token:

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;
using System.Text;

public class JwtService
{
    public string GenerateToken(string username)
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.Name, username)
        };

        var key = new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes("YourSecretKey12345"));

        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var token = new JwtSecurityToken(
            issuer: "yourIssuer",
            audience: "yourAudience",
            claims: claims,
            expires: DateTime.Now.AddMinutes(30),
            signingCredentials: creds);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

4. Create Login API

This API validates user credentials and returns a token:

[ApiController]
[Route("api/[controller]")]
public class AuthController : ControllerBase
{
    private readonly JwtService _jwtService = new JwtService();

    [HttpPost("login")]
    public IActionResult Login(string username, string password)
    {
        // Replace with real DB validation
        if (username == "admin" && password == "password")
        {
            var token = _jwtService.GenerateToken(username);
            return Ok(new { token });
        }

        return Unauthorized();
    }
}

5. Protect API Endpoints

Use [Authorize] attribute:

[ApiController]
[Route("api/[controller]")]
public class TestController : ControllerBase
{
    [HttpGet]
    [Authorize]
    public IActionResult Get()
    {
        return Ok("This is a protected API");
    }
}

1. Client calls /api/auth/login ? receives JWT token

2. Client sends token in header:

   Authorization: Bearer 
   

3. ASP.NET Core middleware:

   • Validates token signature using secret key

   • Checks expiry, issuer, audience

   • Sets HttpContext.User

4. [Authorize] allows or denies access

Store JWT settings in appsettings.json:

"Jwt": {
  "Key": "YourSecretKey12345",
  "Issuer": "yourIssuer",
  "Audience": "yourAudience"
}

This is the complete flow to implement JWT authentication in ASP.NET Core Web API.