identityserver-api-protection

To validate JWT access tokens in ASP.NET Core APIs, configure JwtBearer authentication with ValidTypes = ["at+jwt"] to enforce proper type filtering and prevent token confusion. This ensures your API only accepts correctly typed bearer tokens issued by the expected authority.

Handle both reference tokens and JWTs by forwarding opaque tokens to an OAuth2 introspection endpoint using AddOAuth2Introspection, while validating JWTs locally. Ensure ApiSecrets are configured for secure introspection to enable unified API token handling.

Proof-of-Possession (PoP) validation binds tokens to specific clients and requests to guard against token theft across multi-audience deployments. You need PoP validation when securing APIs with mTLS cnf or DPoP proof, requiring setup with a distributed cache.

Implement scope-based authorization for API resources by creating policies based on token scopes to enforce fine-grained access control. This allows your ASP.NET Core API to restrict access to specific resources based on the scopes granted in the IdentityServer token.

Yes, you can use local API authentication for co-hosted IdentityServer APIs to reduce latency. This approach supports co-hosted deployments by validating tokens locally without requiring external network calls, providing faster authentication for your integrated APIs.

Support multiple API resources and audiences by validating multiple audiences within your JWT bearer authentication configuration. This enables a single API to securely accept tokens intended for different API resources issued by IdentityServer.