Auth0 Token Forwarding to Backend APIs

Your Blazor Server app gets 401 Unauthorized because the user's Auth0 access_token is not automatically attached to outgoing HttpClient requests. You must manually forward the token by setting the Authorization Bearer header on calls to protected backend APIs.

To forward Auth0 access tokens in ASP.NET Core, create a DelegatingHandler that reads the access_token from the current HttpContext and sets the Authorization header. Register this handler on your HttpClient to automatically attach Bearer tokens to outgoing requests.

SaveTokens is an OIDC configuration option that stores the access_token in the authentication session. You must set SaveTokens = true in your Auth0 OIDC options so the DelegatingHandler can read and forward the token to your backend APIs.

Yes, you can use a DelegatingHandler to attach JWT bearer tokens in Blazor Server. You need to register IHttpContextAccessor so the handler can access the current HttpContext, read the Auth0 access_token, and set the Authorization header on outgoing HttpClient requests.

Common pitfalls when forwarding Auth0 tokens include forgetting to register IHttpContextAccessor, not enabling SaveTokens in OIDC options, and failing to add the DelegatingHandler to the HttpClient registration, which prevents the Bearer token from being attached to outgoing requests.