You can verify the scopes in the controller action by using the attribute. Verify the scopes on each controller action You can also verify them at the level of the controller or for the whole application.

In ASP.NET Core, you can use to verify scopes in each controller action.

For more information, see Code configuration | Bearer token. If a client app calls your API on behalf of a user, the API needs to request a bearer token that has specific scopes for the API. Verify scopes in APIs called on behalf of users

The app roles if the API can be called from a daemon app.

The scopes if the API is called on behalf of a user.

These claims in particular need verification: Your API needs to verify that the token used to call the API is requested with the expected claims. It guarantees only that ASP.NET and ASP.NET Core validate the token. Public class TodoListController : Controllerīut this protection isn't enough.

The individual controller action for your API.

The controller itself if you want all controller actions to be protected.

To protect an ASP.NET or ASP.NET Core web API, you must add the attribute to one of the following items:

ASP.NET Core web API incremental tutorial.

The code snippets in this article are extracted from the following code samples on GitHub:

Daemon apps that have the right application roles.

Applications on behalf of users who have the right scopes and roles.

This protection ensures that the API is called only by: This article describes how you can add authorization to your web API.

Identity api scope approval ui