Skip to main content
Start Free Trial

Protect a .NET API

This quickstart uses the official Guardhouse.SDK resource-server integration to validate JWT access tokens in ASP.NET Core.

1. Register the API Resource​

Create an API resource in Guardhouse and give it a stable audience, such as orders_api. Allow the calling client to request the resource and the scopes it needs.

2. Install the SDK​

dotnet add package Guardhouse.SDK

3. Configure Authentication​

Program.cs
using Guardhouse.SDK.Extensions;
using Guardhouse.SDK.Models;
using Microsoft.AspNetCore.Authorization;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddGuardhouseResource(options =>
{
    options.Authority = "https://your-tenant.guardhouse.cloud";
    options.Audience = "orders_api";
    options.ValidationMode = TokenValidationMode.JwtSignature;
});

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/api/public", () => Results.Ok(new { message = "Public" }));

app.MapGet(
    "/api/orders",
    [Authorize(AuthenticationSchemes = "Guardhouse")] () =>
        Results.Ok(new[] { new { id = 1, description = "Example order" } }));

app.Run();

Replace the authority with the tenant issuer and the audience with the API resource identifier. UseAuthentication() must run before UseAuthorization().

4. Call the Endpoint​

Obtain an access token for orders_api, then call:

curl "https://localhost:5001/api/orders" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

The request should return 401 Unauthorized without a valid access token. A valid token issued for a different audience must also be rejected.

5. Add Operation-Level Authorization​

Token validation establishes an authenticated caller; it does not grant every operation. Add ASP.NET Core authorization policies for the scopes, roles, or permissions used by your application, and require those policies on the relevant endpoints.

For direct revocation checks or opaque-token deployments, switch to Guardhouse introspection as described in Protect an API. See the .NET SDK reference for both validation modes.