aspnetcore-authentication

From README

ASP.NET Core Authentication When to Use This Skill Use this skill when: Configuring OIDC authentication in an ASP.NET Core web application Setting up JWT Bearer authentication for an API Managing authentication schemes (cookies, OIDC, JWT, external providers) Implementing challenge, sign-in, sign-out, and forbid flows Debugging authentication failures (401s, redirect loops, claim mapping issues) Integrating with Duende IdentityServer as an OpenID Connect provider Configuring token validation parameters Core Principles Authentication ≠ Authorization — Authentication establishes who the user is. Authorization (see aspnetcore-authorization) determines what they can do. Scheme-Based Architecture — ASP.NET Core authentication is built around named schemes. Each scheme has a handler that knows how to authenticate, challenge, and sign out. Cookies for Web Apps, JWT for APIs — Web applications use cookie authentication (with OIDC for login). APIs use JWT Bearer or introspection.