# Microsoft.Owin.Security.Jwt

**Kind:** Service

**Source:** `Pams/API/Pams.API/Pams.API.csproj` (line 1)

**Part of:** [Pams](subsystem-pams)

NuGet package dependency

`Microsoft.Owin.Security.Jwt` is a NuGet package dependency that adds JWT bearer-token authentication support to the legacy OWIN pipeline. The API project uses it to validate incoming authorization tokens before protected endpoints handle requests.

## Diagram

```mermaid
sequenceDiagram
    participant Client
    participant API as Pams API
    participant Jwt as JWT Middleware
    participant Endpoint as Protected Endpoint

    Client->>API: Request with Authorization bearer token
    API->>Jwt: Pass request through OWIN pipeline
    Jwt->>Jwt: Validate token signature and claims
    Jwt-->>API: Set authenticated user context
    API->>Endpoint: Invoke protected endpoint
    Endpoint-->>Client: Return response
```

## Usage

```typescript
async function getProtectedData(token: string) {
  const response = await fetch("/api/protected-data", {
    headers: {
      Authorization: `Bearer ${token}`,
    },
  });

  if (!response.ok) {
    throw new Error("Request was not authorized");
  }

  return response.json();
}
```

## AI Coding Instructions

- Configure JWT authentication in the OWIN startup pipeline before registering protected Web API routes.
- Send access tokens through the `Authorization` header using the `Bearer` scheme.
- Keep token issuer, audience, signing key, and validation settings aligned with the token-issuing service.
- Do not treat a decoded token as authenticated until the JWT middleware has validated its signature and claims.

## Used by

1 reference from 1 file. Each is a place in this repository where the symbol is actually used — go read one rather than trusting an example.

### Injected or called by (1)

- `Pams.API` — `Pams/API/Pams.API/Pams.API.csproj`:1