Please help me to understand the difference between JWT token validation from the ASP netcore application and the netcore Kestrel hosted application.

There are two applications that verifies token using the source code like below:

```
public static IServiceCollection AddJwtToken(this IServiceCollection services, OAuthConfig config)
{
    services.AddMvc();
    services.AddAuthorization();

    Logger.DebugFormat("AddJwtBearer authority:{0} audience:{1}", config.GetAuthority(), config.Resource);

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options => new JwtBearerOptions
        {
            Authority = config.GetAuthority(),
            Audience = config.Resource,
    });

    return services;
}

```

it is pretty simple and it works well if token is being validated from the asp net core 2.2 application

```
// in the asp.net core
var builder = WebHost.CreateDefaultBuilder(args);
builder
        .UseStartup<Startup>()
        .ConfigureKestrel(_ => _.ConfigureEndpoints())
        .UseSerilog();

```

And there is another application (console) that starts the same rest service host using the `UseKestrel`

```
//in the console app
var builder = WebHost.CreateDefaultBuilder()
    .UseNLog()
    .UseKestrel(_ => _.ConfigureEndpoints())
    .UseStartup<Startup>();

```

the only one significant difference is that there is `UseKestrel` in the console via `ConfigureKestrel` for asp.net core.

The same source code (and configuration) is used to get token from the Azure AD. 
Please find it as [the gist here](https://gist.github.com/oleksabor/a4c873e078f74086ddda57b6b29f2c74). 
It is configured to get token from the `https://login.microsoftonline.com/{tenant}/v2.0` provider. The same token endpoint, clientid, secret and scope values are used for both cases.

The problem is that `AddJwtBearer` validates the token in the asp.net core and does not in the console app. 
the error is 

```
Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys:
kid: 'BB8CeFVqyaGrGNuehJIiL4dfjzw',
token: '{"typ":"JWT","alg":"RS256","kid":"BB8CeFVqyaGrGNuehJIiL4dfjzw"}.{"aud":"2c163c99-935b-4362-ae0d-657f589f5565","iss":"https://login.microsoftonline.com/{tenantidhere}/v2.0

```

Why asp.net core host validates the token (for the first `AddJwtBearer` implementation) and console host fails?

Thank you