title: Authorize method inside API controller to specific user
body: <p>I am creating my own API application and I would like to know what is the best practice to authorize a user in order to call method inside controller.</p>
  <p>I am not talking about authentication, I am already doing that by using IdentityServer4, but now I want to limit users which API methods they can call.</p>
  <p>Not sure was this a right direction but for earlier asp.net versions, I saw the documentation saying there was an option to allow access to just specific users, but now in .net core, there are only role, claim and policy based authorization.</p>
  <p>p.s. &quot;authentication is the process of verifying who a user is, while authorization is the process of verifying what they have access to.&quot;, saying this just so that you understand my needs better.</p>
  <p>thanks</p>