# Secure Your .NET 6 Web API **URL:** \ **Category:** Developer Blog Comments\ **Created:** [April 20, 2022, 2:29pm UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324 "2022-04-20T14:29:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [April 20, 2022, 2:29pm UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/1 "2022-04-20T14:29:48Z")
.NET 6 is here and many of us are making preparations to update .NET 5 codebases to .NET 6. As part of this review, today you will learn how to implement the client credentials flow in ASP.NET Core Web API. * * * This is a companion discussion topic for the original entry at [https://developer.okta.com/blog/2022/04/20/dotnet-6-web-api](https://developer.okta.com/blog/2022/04/20/dotnet-6-web-api) ---
**Author:** ![dmckisic](https://avatars.discourse-cdn.com/v4/letter/d/3be4f8/32.png) [@dmckisic](https://devforum.okta.com/u/dmckisic)\ **Post date:** [April 26, 2022, 4:24am UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/2 "2022-04-26T04:24:05Z")
Hi, thanks for the informative post–very helpful to see the implementation. This part caught my attention: “At this time, Okta does not provide a JWT Verification library for .NET”. I’ve worked through this Okta guide here: [Protect your API endpoints | Okta Developer](https://developer.okta.com/docs/guides/protect-your-api/aspnetcore3/main/) That Okta guide includes using an Okta nuget package that “enables your application to validate Okta access tokens”. I’m trying to reconcile that Okta guide and your statement–when you say “At this time, Okta does not provide a JWT Verification library for .NET” are you saying this, because the nuget package in the Okta guide is too specific in validating only Okta access tokens and cannot be used to serve a broader need to verify a JWT regardless of where it came from? ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [April 26, 2022, 4:24am UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/3 "2022-04-26T04:24:05Z")
Listed on April 26, 2022, 4:24am UTC ---
**Author:** ![laura.rodriguez](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/laura.rodriguez/32/611_2.png) [@laura.rodriguez](https://devforum.okta.com/u/laura.rodriguez)\ **Post date:** [April 27, 2022, 9:18pm UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/4 "2022-04-27T21:18:40Z")
Hi @dmckisic, You’re right. The Okta.AspNet SDK is specific to Okta and the [ASP.NET](http://ASP.NET) framework. If you need to validate tokens in other projects where the Okta.ASPNET is not an option you can do your validation manually as explained [here](https://developer.okta.com/docs/guides/validate-access-tokens/dotnet/main/#decoding-and-validating-the-access-token). I hope this helps! ---
**Author:** ![Vasili](https://avatars.discourse-cdn.com/v4/letter/v/a698b9/32.png) [@Vasili](https://devforum.okta.com/u/Vasili)\ **Post date:** [November 19, 2022, 8:18pm UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/5 "2022-11-19T20:18:00Z")
Hi, Laura. Very good explanation. I have reviewed it, but it doesn’t work for Postman as you described this. But could you provide a description how integrate OKTA with [ASP.NET](http://ASP.NET) Core .NET 6, when ClientId and Secretes are used in the code directly and when call some end-point, user in a browser authmatically redirected to the OKTA login page.Really very few documentaion on OKTA integration with .NET 6 [ASP.NET](http://ASP.NET) Core. Could you provide it please. Best regards, Vasili Holub ---
**Author:** ![ericbrown](https://avatars.discourse-cdn.com/v4/letter/e/dec6dc/32.png) [@ericbrown](https://devforum.okta.com/u/ericbrown)\ **Post date:** [January 27, 2023, 4:29pm UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/6 "2023-01-27T16:29:28Z")
Great explanation, As a c# webapi dev who’s used okta before to secure a webapi (.net core 3.1)b, you should re-write this to use the [Authorize] tag on the controller or controller method., instead of manually checking the token. There is no way I’d use this article, for that single fact alone, even though I quite like rest of your implementation. [Authorize] is the best practice for how to add authentication to a controller method. See how it’s implemented in this Okta article for .NetCore 3.1, using the tag correctly. > **[Protect your API endpoints | Okta Developer](https://developer.okta.com/docs/guides/protect-your-api/aspnetcore3/main/#require-authorization-for-everything)** > > Secure, scalable, and highly available authentication and user management for any app. Thanks, Eric- ---
**Author:** ![abhijeet.tidke](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@abhijeet.tidke](https://devforum.okta.com/u/abhijeet.tidke)\ **Post date:** [February 13, 2023, 10:22pm UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/7 "2023-02-13T22:22:31Z")
hi, I am trying to call Okta service from Postman but getting invalid\_client error and summary is “Invalid value for ‘client\_id’ parameter”. Can you please guide me what might be going wrong here? thanks. ---
**Author:** ![Epos7](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@Epos7](https://devforum.okta.com/u/Epos7)\ **Post date:** [April 19, 2023, 1:14am UTC](https://devforum.okta.com/t/secure-your-net-6-web-api/20324/8 "2023-04-19T01:14:51Z")
Thanks for your comment @ericbrown I was about to go through all the steps to manually validate the token, not knowing I didn’t have to. I’m even using .NET authorization with the [Authorized] tags and having trouble with it, so I was about to start fresh with this article. Instead I followed the article you linked to and just needed a few tweaks to get up and running. While I appreciate a detailed guide to manually validating tokens in .NET, it really should say that it isn’t necessary except in specific circumstances perhaps.