title: IDX:20803 Unable to obtain configuration from... - Web API
body: <p>Hi I am trying to test a simple WebApi application with JWT token. Mainly, I have followed the example <a href="https://jasonwatmore.com/post/2019/10/11/aspnet-core-3-jwt-authentication-tutorial-with-example-api" rel="nofollow noreferrer">here</a></p>
  
  <p>I am using https.</p>
  
  <p>For the time-being, Authorization is not used. The issue is that everything works fine if I choose "Inherit auth from parent" in <strong>Postman</strong>.</p>
  
  <p>As soon as I change option to "BearerToken" and try to enter the JSONWebToken that I received, it gives me </p>
  
  <blockquote>
    <p>System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '<a href="https://localhost:44387/api/.well-known/openid-configuration" rel="nofollow noreferrer">https://localhost:44387/api/.well-known/openid-configuration</a>'.
     ---> System.IO.IOException: IDX20804: Unable to retrieve document from: '<a href="https://localhost:44387/api/.well-known/openid-configuration" rel="nofollow noreferrer">https://localhost:44387/api/.well-known/openid-configuration</a>'.
     ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found).
       at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
       at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
       --- End of inner exception stack trace ---
       at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)</p>
  </blockquote>
  
  <p>Please note, I am not using <strong>IdentityServer</strong> middleware here, and on browser also, I am unable to browse to <a href="https://localhost:44387/api/.well-known/openid-configuration" rel="nofollow noreferrer">https://localhost:44387/api/.well-known/openid-configuration</a></p>
  
  <p>I am not sure where this <strong>"openid-configuration"</strong> is, specially when I am not explicitly using it in my <strong>aspnet Core 3.0</strong> web APi application? Here is my code..</p>
  
  <p><strong>Startup.cs</strong></p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
      { 
       //extra code removed for brevity
       //Authentication
              services.AddAuthentication(options =&gt;
              {
                  options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              }).AddJwtBearer(options =&gt;
              {
                  options.Authority = "https://localhost:44387/api";
                  options.Audience = "JWT:Issuer";
                  options.TokenValidationParameters.ValidateLifetime = true;
                  options.TokenValidationParameters.ClockSkew = TimeSpan.FromMinutes(5);
                  options.RequireHttpsMetadata = false;
  
              });
   }
  
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
      {
         if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
          else
          {
              //to send HTTP Strict Transport Security Protocol (HSTS) headers to clients.
              app.UseHsts();
          }
  
          //to redirect HTTP requests to HTTPS.
          app.UseHttpsRedirection();
  
          app.UseAuthentication();
  
          app.UseRouting();
  
  
  
  
  
          app.UseEndpoints(endpoints =&gt;
          {
  
              endpoints.MapControllers();
  
              endpoints.MapRazorPages();
          });
      }
  </code></pre>
  
  <p>Instead of <em><a href="https://localhost:44387/api" rel="nofollow noreferrer">https://localhost:44387/api</a></em> I have also tried <em><a href="https://localhost:44387/" rel="nofollow noreferrer">https://localhost:44387/</a></em> and <em><a href="https://localhost" rel="nofollow noreferrer">https://localhost</a></em> but no luck.. I am mainly trying to understand why openid is coming up when I didnot use it at all. Everything is on my local machine and I am using IISExpress.</p>
  
  <p>I have also tried deleting and recreating localhost SSL certificates by Repairing IISExpress.</p>
  
  <p>Any clue will be helpful.</p>