# Securing a Web API with JWT Bearer

Give the categories API users. Register and login endpoints check passwords with PasswordHasher and hand back a signed JSON Web Token; AddJwtBearer checks the token on every request, and \[Authorize\] with roles decides who may add, change and delete. The signing key lives in user secrets.

![Cheat sheet: Securing a Web API with JWT Bearer](https://fsdtrainingmedia.blob.core.windows.net/public/images/2026/11/78fb52ebf3434086b8135e24c42aabf9.webp)

- Category: ASP.NET Core
- Level: Journeyman
- Tags: aspnet-core, Bearer Token, JWT Bearer Authentication, rest-api, User Secrets
- Updated: November 3, 2026

Source: https://www.ask-codey.com/cheat-sheets/securing-the-web-api-securing-a-web-api-with-jwt-bearer-cheat-sheet