Authentication and authorization for ASP.NET Core. Covers JWT bearer tokens, OpenID Connect, ASP.NET Identity, authorization policies, role and claim-based authorization, and API key authentication. Load this skill when implementing login, protecting endpoints, designing authorization rules, or when

Authentication & Authorization Core Principles 1. Use ASP.NET Identity for user management — Don't build your own user store. Identity handles password hashing, lockout, two factor, email confirmation, and (since .NET 10) built in passkey/WebAuthn support for passwordless login. 2. JWT for APIs, cookies for web apps — APIs use Bearer token authentication; Blazor/MVC apps use cookie authentication. 3. Policy based authorization over roles — Policies are testable, composable, and more expressive than [Authorize(Roles = "Admin")] . 4. Never store secrets in code — Use user secrets in development, Azure Key Vault / environment variables in production. Patterns JWT Bearer Authentication Token Generation Use JsonWebTokenHandler from Microsoft.IdentityModel.JsonWebTokens — it is the maintained, span based handler that ASP.NET Core itself validates with. JwtSecurityTokenHandler (System.IdentityModel.Tokens.Jwt) is the legacy stack. Policy Based Authorization Protecting Endpoints OpenID Connect (External Identity Provider) Accessing Current User Anti patterns Don't Use Role Strings Everywhere Don't Store Secrets in appsettings.json Don't Skip Token Validation Decision Guide Scenario Recommendation REST API JWT Bearer authentication Blazor Server / MVC Cookie authentication External identity provider OpenID Connect User registration / login ASP.NET Identity Passwordless login ASP.NET Identity passkeys (WebAuthn, built in since .NET 10) Permission checking Policy based authorization Multi tenant API Claims based with tenant claim API to API communication Client credentials (OAuth 2.0) Simple API keys Custom AuthenticationHandler<T