9. JWT authentication

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(o =>
    {
        o.Authority = "https://login.microsoftonline.com/<tenant-id>/v2.0";   // or your identity server
        o.Audience = "api://shop-api";
        // for self-issued tokens instead:
        // o.TokenValidationParameters = new() { ValidateIssuer = true, ValidIssuer = "...", ValidateAudience = true,
        //     ValidAudience = "...", ValidateLifetime = true, IssuerSigningKey = new SymmetricSecurityKey(keyBytes), ClockSkew = TimeSpan.FromMinutes(1) };
    });
builder.Services.AddAuthorization(o => o.AddPolicy("orders.write", p => p.RequireClaim("scp", "Orders.Write")));

app.UseAuthentication();
app.UseAuthorization();