title: Network calls /.well-known/openid-configuration/ and /.well-known/openid-configuration/jwks
body: <p>I have :</p>
  
  <ul>
  <li>Identity server 4, </li>
  <li>Mvc app with OpenId Connect and Hybrid flow </li>
  <li>WebApi app</li>
  </ul>
  
  <p>Assume user already got cookies with id_token and access token.
  Then he calls an action from mvc app:</p>
  
  <pre><code> var client = new HttpClient();
   client.SetBearerToken(accessToken);
  // call webapi from mvc
   var content = await client.GetStringAsync("http://localhost:5001/api/resource-with-policy");
  </code></pre>
  
  <p>In fiddler i see two calls:</p>
  
  <ul>
  <li><p>GET /.well-known/openid-configuration/ </p></li>
  <li><p>GET /.well-known/openid-configuration/jwks</p></li>
  </ul>
  
  <p>As i assume WebApi sees [Authorize] attribute on action and make these calls.
  What's purpose of these calls?</p>
  
  <p>WebApi is configured this way:</p>
  
  <pre><code>              .AddJwtBearer("Bearer", options =&gt;
                {options.Authority = "&lt;is4-url&gt;";
                    options.RequireHttpsMetadata = false;
                    options.Audience = "Api1";
                });```
  
  </code></pre>