This guide shows how to protect .NET API endpoints using the MonoCloud API Authentication .NET SDK.
Because the SDK registers a standard ASP.NET Core authentication scheme, you protect endpoints with the built-in [Authorize] attribute, RequireAuthorization(), and the authorization policy system.
This guide assumes you've completed the .NET quickstart or the installation guide.
You should already have:
MonoCloud.Authentication.Api SDK installedMonoCloud section configured in appsettings.jsonAdd a fallback authorization policy to require a valid access token for every endpoint.
using System.Security.Claims;
using MonoCloud.Authentication.Api;
var builder = WebApplication.CreateBuilder(args);
builder.Services
.AddAuthentication(MonoCloudAuthenticationDefaults.AuthenticationScheme)
.AddMonoCloudAuthentication(options =>
{
options.TenantDomain = builder.Configuration["MonoCloud:TenantDomain"];
options.Audience = builder.Configuration["MonoCloud:Audience"];
});
builder.Services.AddAuthorization(options =>
{
options.FallbackPolicy = options.DefaultPolicy;
});
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/api/data", (ClaimsPrincipal user) => new
{
claims = user.Claims.Select(claim => new { claim.Type, claim.Value }),
});
app.Run();
How it works:
AddMonoCloudAuthentication() validates the Authorization: Bearer <token> headerFallbackPolicy applies to every endpoint that doesn't specify its own authorizationHttpContext.UserApply authorization to specific endpoints instead of globally. Mark public endpoints with .AllowAnonymous() — they stay public even when a FallbackPolicy is set.
app.MapGet("/api/public", () => new { message = "Public data" })
.AllowAnonymous();
app.MapGet("/api/protected", (ClaimsPrincipal user) => new
{
claims = user.Claims.Select(claim => new { claim.Type, claim.Value }),
});
Set RoleClaimType so the SDK maps the token's group memberships to roles, then require a role.
builder.Services
.AddAuthentication(MonoCloudAuthenticationDefaults.AuthenticationScheme)
.AddMonoCloudAuthentication(options =>
{
options.TenantDomain = builder.Configuration["MonoCloud:TenantDomain"];
options.Audience = builder.Configuration["MonoCloud:Audience"];
options.RoleClaimType = "groups";
});
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("engineering", policy => policy.RequireRole("engineering"));
});
app.MapGet("/api/team", () => "Team data")
.RequireAuthorization("engineering");
Behavior:
401 Unauthorized if the token is missing or invalid403 Forbidden if the token is valid but the user is not in the required group| Scenario | Status code | Response |
|---|---|---|
| Missing or invalid token | 401 | Unauthorized |
| Valid token, missing group | 403 | Forbidden |
| Valid token, authorized | — | Endpoint handler executes |