OAuth 2.0 and JWT Authorization in C#: A Complete Guide

Introduction to OAuth 2.0 and JWT in C#

Modern web applications and APIs require a reliable authorization system. The two most popular standards — OAuth 2.0 (delegated access protocol) and JWT (JSON Web Token, token format) — have become the foundation of security in the .NET ecosystem. In this article, we will analyze how to implement OAuth 2.0 and JWT authorization in C# in ASP.NET Core, create an example authorization server, and protect an API.

Whether you are building a monolithic application or a microservice architecture, understanding these mechanisms is critically important. OAuth 2.0 defines roles (client, authorization server, resource server), while JWT serves as a compact and self-contained way to transmit user data.

Fundamentals of OAuth 2.0: Flows and Roles

What is OAuth 2.0?

OAuth 2.0 is an authorization protocol that allows third-party applications to obtain limited access to user resources without transmitting their credentials. Instead of a login and password, access tokens are used.

Main Roles in OAuth 2.0

• Resource Owner — the user who owns the data.
• Client — the application requesting access.
• Authorization Server — the server that issues tokens after authentication.
• Resource Server — the API that protects resources and validates tokens.

Popular Grant Types

• Authorization Code — for server-side applications (most secure).
• Client Credentials — for server-to-server communication (without a user).
• Implicit — deprecated, not recommended.
• Refresh Token — for obtaining a new access token without re-entering the password.

JWT (JSON Web Token): Structure and Working Principle

What Does a JWT Consist Of?

A JWT is a string consisting of three parts separated by dots:

header.payload.signature

• Header — the token type and signing algorithm (e.g., HS256 or RS256).
• Payload — the data (claims): user identifier, roles, expiration time, etc.
• Signature — the signature that verifies the token has not been altered.

Advantages of JWT for C#

• Self-contained — all user data is inside the token.
• Easy validation on the resource server side without database queries.
• Support in .NET through the Microsoft.AspNetCore.Authentication.JwtBearer library.

Implementing OAuth 2.0 + JWT in C# in ASP.NET Core

1. Setting Up the Authorization Server (Issuing JWT)

Let's create a minimal server that accepts a login/password and returns a JWT. For simplicity, we will use a symmetric key (HS256).

// Program.cs — authorization serverusing Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.IdentityModel.Tokens;using System.IdentityModel.Tokens.Jwt;using System.Security.Claims;using System.Text;

var builder = WebApplication.CreateBuilder(args);builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)    .AddJwtBearer(options =>    {        options.TokenValidationParameters = new TokenValidationParameters        {            ValidateIssuer = true,            ValidateAudience = true,            ValidateLifetime = true,            ValidateIssuerSigningKey = true,            ValidIssuer = "MyAuthServer",            ValidAudience = "MyApiClient",            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("SuperSecretKey123!@#$%"))        };    });

builder.Services.AddAuthorization();var app = builder.Build();

app.MapPost(