Securing the Web API

Securing the Web API: Securing a Web API with JWT Bearer.

Updated November 3, 2026

1. Securing a Web API with JWT Bearer (Journeyman): Give the categories API users. Register and login endpoints check passwords with PasswordHasher and hand back a signed JSON Web Token; AddJwtBearer checks the token on every request, and [Authorize] with roles decides who may add, change and delete. The signing key lives in user secrets.