Note: this article was drafted with AI assistance and reviewed by Softinbit Technology before publishing. It is part of the series The .NET Implementation Playbook .

Register users, log them in, and protect endpoints with signed 15-minute access tokens.

Part of "The .NET Implementation Playbook". Section: Authentication and Security.

TL;DR

Issue signed 15-minute access tokens for ASP.NET Core Identity users with JsonWebTokenHandler , the same handler JwtBearer uses to validate them.

Validate strictly: issuer, audience, lifetime, HS256 only, a 30-second clock skew, and a signing key whose length is checked at startup.

Avoid the classic traps: claim mapping that hides sub , AddIdentity in an API, and authentication middleware in the wrong order.

Level: Intermediate · Prerequisites: An ASP.NET Core Web API project, basic EF Core, SQL Server or LocalDB · Reading time: 13 min

Your Angular app and a mobile client both need to call Store.Api , and the ticket says "add login".…