title: .NET Core 2.0 Identity AND jwt?
body: <p>I've been looking around and trying to do more research on .NET Core Identity (<a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-2.1&amp;tabs=visual-studio%2Caspnetcore2x" rel="noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-2.1&amp;tabs=visual-studio%2Caspnetcore2x</a>) and Jwt (json web tokens). I've been rolling with the default Identity as authentication/authorization in my .NET Core 2.0 app and it has been working well so far.</p>
  
  <p>I'm running into a roadblock and I think it's the way of my understanding of .NET Core identity and jwt. My application has MVC and an web api. I would <em>ideally</em> like to secure the web api, but I hear the best way to do that now is through jwt. Good - cool.</p>
  
  <p>I can go ahead and configure jwt and then use it as my authentication/authorization (<a href="https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/" rel="noreferrer">https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/</a>), but - do I need to go ahead and spin up a new server to serve as the authorization server for jwt? If so, I'm not going to do that (too expensive).</p>
  
  <p>What about my .NET Core identity code if I <em>do</em> go with jwt? Does that have to go away then? If it can co-exist, how might I authorize my MVC pages with Identity and my api endpoints with jwt?</p>
  
  <p>I realize this is an open-ended question, but the core of it is:</p>
  
  <p><strong>Can .NET Core Identity and JWT co-exist? Or do I have to choose one or the other? I have MVC and an web api and would like to secure both.</strong></p>