All 15 API Documentation with Swagger/OpenAPI questions
More in API Documentation with Swagger/OpenAPI
How do you customize example values shown in Swagger UI for request and response bodies? How do you validate that an API's actual behavior matches its published OpenAPI specification, preventing documentation drift? How do you version your OpenAPI documentation to reflect API versioning implemented via the Asp.Versioning library? How do you add global metadata (like a description, contact info, and license) to the top level of a generated OpenAPI document? How does the newer built-in Microsoft.AspNetCore.OpenApi package (introduced in .NET 9) differ from the third-party Swashbuckle package? How would you exclude specific endpoints or entire controllers from appearing in the generated Swagger documentation? How would you generate a client SDK automatically from an ASP.NET Core API's OpenAPI specification? What is 'design-first' versus 'code-first' API development, and how does OpenAPI tooling support each approach? How do you document and test webhook or callback endpoints (server-initiated calls to a client-registered URL) in OpenAPI 3.1? How does schema reuse work in OpenAPI (via $ref and components/schemas), and how does Swashbuckle handle types shared across multiple endpoints?
Advertisement
ASP.NET Core › API Documentation with Swagger/OpenAPI

How do you document authentication requirements (like a JWT bearer token) in Swagger UI so users can test authenticated endpoints interactively?

Advanced

Answer

Configure AddSecurityDefinition to describe the authentication scheme (e.g., Bearer JWT) and AddSecurityRequirement to apply it globally or per-operation, which adds an 'Authorize' button in Swagger UI where users can paste a token that's then automatically included as an Authorization header on every subsequent 'Try it out' request made from the UI.
builder.Services.AddSwaggerGen(c => {
    c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme {
        Type = SecuritySchemeType.Http, Scheme = "bearer", BearerFormat = "JWT"
    });
    c.AddSecurityRequirement(new OpenApiSecurityRequirement {
        { new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Bearer" } }, Array.Empty<string>() }
    });
});
Real-world example A secured internal API lets developers paste a test JWT into Swagger UI's Authorize dialog once, then interactively try every protected endpoint directly from the browser without needing a separate tool like Postman for manual header configuration.

Common follow-ups: How do you apply security requirements to only specific endpoints instead of globally?;How does this differ for API key or OAuth2 authentication schemes?

Authentication;Authorization
All 15 API Documentation with Swagger/OpenAPI questions