Authorization methods in .NET microservices

Today I want to dive into one of the most critical stages of microservices development: authorization . This stage can bring significant complexity . Each service is now a separate HTTP server with its own endpoints , and the client (bot, frontend, mobile app) must have simultaneous access to all of them . Theory: Authentication vs Authorization in Microservices In microservices architecture, it's crucial to distinguish between: Authentication — who is this? Authorization — what is this subject allowed to do? Authentication is typically handled by a dedicated Identity Provider (IdP) or Auth service , while microservices accept already-validated tokens and decide what the client can access. Main Authorization Approaches in Microservices Session-based authorization (cookies + server-side session store) Token-based: -> JWT (JSON Web Token) -> Opaque tokens OAuth 2.0 / OpenID Connect (OIDC) on top of tokens (usually JWT) API Keys mTLS (mutual TLS) — mutual TLS authentication between servic