Use Multiple Schemes

This guide shows how to register multiple MonoCloud authentication schemes in a single .NET API using the MonoCloud API Authentication .NET SDK.

When to use multiple schemes

Each call to AddMonoCloudAuthentication registers an independent authentication scheme with its own configuration. Use multiple schemes when:

You protect multiple APIs with different audiences in the same application
You accept tokens from different applications
Different parts of your API require different validation settings (for example, one uses introspection and another validates JWTs locally)

Before you begin

This guide assumes you've completed the installation guide.

You should already have:

An ASP.NET Core project
The MonoCloud.Authentication.Api SDK installed
The MonoCloud section configured in appsettings.json

Register multiple schemes

Give each scheme a unique name — the first scheme uses the default scheme name, and additional schemes are named explicitly. To select which scheme validates an endpoint, define a policy per scheme with AddAuthenticationSchemes and apply it with RequireAuthorization. On controllers, you can alternatively use [Authorize(AuthenticationSchemes = ...)].

Program.cs

using System.Security.Claims;
using MonoCloud.Authentication.Api;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(MonoCloudAuthenticationDefaults.AuthenticationScheme)
    .AddMonoCloudAuthentication(options =>
    {
        options.TenantDomain = builder.Configuration["MonoCloud:PublicApi:TenantDomain"];
        options.Audience = builder.Configuration["MonoCloud:PublicApi:Audience"];
    })
    .AddMonoCloudAuthentication("MonoCloud.Admin", options =>
    {
        options.TenantDomain = builder.Configuration["MonoCloud:AdminApi:TenantDomain"];
        options.Audience = builder.Configuration["MonoCloud:AdminApi:Audience"];
    });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("PublicApi", policy =>
    {
        policy.AddAuthenticationSchemes(MonoCloudAuthenticationDefaults.AuthenticationScheme);
        policy.RequireAuthenticatedUser();
    });

    options.AddPolicy("AdminApi", policy =>
    {
        policy.AddAuthenticationSchemes("MonoCloud.Admin");
        policy.RequireAuthenticatedUser();
    });
});

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/api/data", (ClaimsPrincipal user) => new
{
    message = "Public API data",
    scheme = user.Identity?.AuthenticationType,
})
.RequireAuthorization("PublicApi");

app.MapGet("/api/admin", (ClaimsPrincipal user) => new
{
    message = "Admin API data",
    scheme = user.Identity?.AuthenticationType,
})
.RequireAuthorization("AdminApi");

app.Run();

How it works:

Each scheme keeps its own TenantDomain, Audience, keys, and cache
A policy's AddAuthenticationSchemes decides which scheme validates the incoming token
An endpoint accepts a token only if it is valid for the scheme its policy targets
user.Identity?.AuthenticationType returns the name of the scheme that authenticated the request

Use Multiple Schemes

When to use multiple schemes

Before you begin

Register multiple schemes

Next steps