--- title: "Auth Series #6 - Secure Open API (Swagger) calls with Microsoft Entra ID/Azure AD" description: "Auth Series #6 - Secure Open API (Swagger) calls with Microsoft Entra ID/Azure AD This is the 6th tutorial of the Auth Series. Previously in the 5th tutori" image: https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_22.png --- [Skip to the main content.](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#main-content) - [Privacy Policy](https://uptec.io/privacy-policy-1) - [Modern Slavery](https://uptec.io/modern-slavery-statement) - [Net Zero Pledge](https://uptec.io/en-us/net-zero) [![Logo-Transparant](https://uptec.io/hs-fs/hubfs/Logo-Transparant.png?width=936&height=804&name=Logo-Transparant.png "Logo-Transparant")](https://uptec.io/) [![Logo-Transparant](https://uptec.io/hs-fs/hubfs/Logo-Transparant.png?width=936&height=804&name=Logo-Transparant.png "Logo-Transparant")](https://uptec.io/) - [Home](https://uptec.io) - [Products](https://uptec.io/products) - [Services](https://uptec.io/services) - [About](https://uptec.io/about) - [News & Insights](https://uptec.io/blog) - [Contact Us](https://uptec.io/contact-us) - [Careers](https://uptec.io/careers) Search Toggle Menu Search Toggle Menu - [Home](https://uptec.io) - [Products](https://uptec.io/products) - [Services](https://uptec.io/services) - [About](https://uptec.io/about) - [News & Insights](https://uptec.io/blog) - [Contact Us](https://uptec.io/contact-us) - [Careers](https://uptec.io/careers) [Facebook](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#0) [Instagram](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#0) [Linkedin](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#0) [X](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#0) [YouTube](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#0) [Medium](https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad#0) 3 min read # Auth Series #6 - Secure Open API (Swagger) calls with Microsoft Entra ID/Azure AD [Mirza Ghulam Rasyid](https://uptec.io/blog/author/mirza-ghulam-rasyid) : Dec 8, 2023, 1:32:00 PM ![Auth Series #6 - Secure Open API (Swagger) calls with Microsoft Entra ID/Azure AD](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_22.png) # Auth Series #6 - Secure Open API (Swagger) calls with Microsoft Entra ID/Azure AD ![2024 01 27 00H18 23](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h18_23.gif) This is the 6th tutorial of the **Auth Series**. Previously in the 5th tutorial - [# Auth Series #5 - Call Microsoft Entra ID/Azure AD Protected Web API via ASP.NET Core MVC using Authorization Code Flow](https://github.com/mirzaevolution/Uptec-Web-App-Calls-Protected-Api-Authorization-Code-Flow) we created a sample protected Todo Api and Todo Web App (ASP.NET Core MVC) and make the web calls to the api via Authorization Code Flow to access the protected api. Now, we want to improve our Todo Api to have an open api a.k.a **Swagger** integrated into the project. So, we can test our api without having to setup any client application like we did in 5th tutorial series. Enabling Swagger only is not enough. We need to make sure that our Swagger can authenticate against the api itself. So, the Swagger will act like the client app to get the token to access the api. That’s why we need to register our Swagger to app registration in azure. For those that have not followed our 1st and 2nd tutorials, I encourage you to read those first to make sure you have better understanding on how to setup the app registrations. - [Auth Series #1 - Microsoft Entra ID/Azure AD Authentication using ASP.NET Core MVC](https://github.com/mirzaevolution/Uptec-Entra-Id-Web-Login) - [Auth Series #2 - Protect ASP.NET Core Api with Microsoft Entra ID/Azure AD and Access It via Postman](https://github.com/mirzaevolution/Uptec-Protected-Web-Api) ### 1. Register Swagger as Client Application If you follow along our 2nd tutorial, we have created two new app registrations: - **uptec-auth-api**: This app registration used by our protected apis previously - **uptec-auth-api-caller**: This app registration used by client apps to call the protected api ![2024 01 26 21H29 33](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_21h29_33.png) To register our Swagger, make sure you go to the **uptec-auth-api-caller**. In the Overview page, click the Endpoints button and take a note of both values of **“OAuth 2.0 authorization endpoint (v2)”** and **“OAuth 2.0 token endpoint (v2)”**. We will need those urls in our Swagger to do authentication. ![2024 01 26 21H30 14](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_21h30_14.png) Next, you should go to the **Authentication** page/menu. On that page, click **Add a platform** button (you can follow this only if you haven’t created one) and select the **“Single-page application”**. ![2024 01 26 22H38 10](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_22h38_10.png) Enter this value in the redirect uris: `https://localhost:8181/swagger/oaut2-redirect.html`. Why do we use port 8181 ? In our sample project Todo Api, we used port 8181 in our previous tutorial (5th tutorial). This is optional, if you used different port previously, you can adjust based on your setup. ![2024 01 26 22H39 14](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_22h39_14.png) ![2024 01 26 21H54 52](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_21h54_52.png) After that, scroll down the page until you find checkbox with label **“ID tokens (used for implicit and hybrid flows)”**. Make sure you tick that to enable implicit flow/hybrid flow in our swagger to get the token for authentication. Don’t forget to hit save after changes we made. The last step is to take a note of the scopes we created earlier for the API (in the **uptec-auth-api**’s app registration). Because in the previous tutorials we have requested the permission inside the **uptec-auth-api-caller**, you don’t need to switch to **uptec-auth-api**. Just go to the API permissions, click the Access.Read & Access. Write permissions and copy the full permission names like in the screenshots below. ![2024 01 26 21H59 38](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_21h59_38.png) ![2024 01 26 21H59 54](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_21h59_54.png) ![2024 01 26 22H00 00](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_22h00_00.png) **NB: Make sure you follow the previous tutorials to understand how to expose scopes and use them in your api and client apps** ### 2. Integrate Swagger and Configure the Authentication Because in our Todo Api project we haven’t configured the Swagger yet, we need to setup the Swagger first. Install the `Swashbuckle.AspNetcore` nuget package in our **UptecTodoApi** project. ![2024 01 26 21H56 19](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_21h56_19.png) Go to **appsettings.json**, and add this additional config for swagger. ``` "Swagger": { //client id of the caller "ClientId": "CALLER_CLIENT_ID", //auth endpoint of the caller "AuthorizationEndpoint": "https://login.microsoftonline.com/API_TENANT_ID/oauth2/v2.0/authorize", //token endpoint of the caller "TokenEndpoint": "https://login.microsoftonline.com/API_TENANT_ID/oauth2/v2.0/token", //scopes of the api (Access.Read & Access.Write) in full pattern separated by space "Scopes": "api://3a9b9211-6791-4992-b779-bb05935f708b/Access.Read api://3a9b9211-6791-4992-b779-bb05935f708b/Access.Write" } ``` ![2024 01 26 22H12 59](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-26_22h12_59.png) Last step, we need to register the swagger in the Program.cs and configure its auth as well. ![2024 01 27 01H05 44](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_01h05_44.png) Add these blocks to the service collection part. -> Configure the SwaggerGen ``` string[] scopes = config["Swagger:Scopes"]?.Split(' ') ?? new string[0]; services.AddSwaggerGen(c => { c.SwaggerDoc("v1", new OpenApiInfo { Title = "UptecTodoApi", Version = "v1", }); c.AddSecurityDefinition("OAuth2", new OpenApiSecurityScheme { Name = "OAuth2", Type = SecuritySchemeType.OAuth2, Flows = new OpenApiOAuthFlows { AuthorizationCode = new OpenApiOAuthFlow { AuthorizationUrl = new Uri(config["Swagger:AuthorizationEndpoint"] ?? string.Empty), TokenUrl = new Uri(config["Swagger:TokenEndpoint"] ?? string.Empty), Scopes = scopes?.ToDictionary(c => c) } } }); c.AddSecurityRequirement(new OpenApiSecurityRequirement { { new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "OAuth2" } }, scopes } }); }); ``` The code above will tell the Swagger that we’re going to use Authorization Code Flow with the authorization endpoint and token endpoint we got from the previous step. And Swagger will use Scopes we got from API registration (**Access.Read** & **Access.Write**) that listed in the **appsettings.json** config. Add these blocks in the app builder blocks to enable the Swagger UI. ``` app.UseSwagger(); app.UseSwaggerUI(c => { c.SwaggerEndpoint("/swagger/v1/swagger.json", "Todo Api v1"); c.OAuthClientId(config["Swagger:ClientId"]); c.OAuthUsePkce(); c.OAuthScopes(scopes); }); ``` **NB: Details can be seen in the source code in the GitHub** ### 3. Test the Swagger Authentication Ok, now we are going to test our Swagger. When you run the project, go to /swagger url to open the Swagger UI. ![2024 01 27 00H14 12](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_12.png) Do you notice Authorize button above? That button used to authenticate our calls. If you don’t hit that for authentication, when you test the api, you’ll get 401 like in the screenshot below. ![2024 01 27 01H14 50](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_01h14_50.png) Hit, the authorize button, and select all scopes and then login to your MS Account registered with the Azure. ![2024 01 27 00H14 22](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_22.png) ![2024 01 27 00H14 31](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_31.png) ![2024 01 27 00H14 59](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_59.png) Once completed, let’s try to create a post request (create Todo) and then try to get all todos. ![2024 01 27 00H15 47](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h15_47.png) ![2024 01 27 00H15 53](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h15_53.png) ![2024 01 27 00H16 05](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h16_05.png) Awesome. Now we can access/test our endpoints without using Postman or other client applications. ![2024 01 27 00H18 23](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h18_23.gif) Ok, i think that’s all for this tutorial. You can check the source code here: > Todo Api: https://github.com/mirzaevolution/UptecTodoApi Regards, **Mirza Ghulam Rasyid** - [Tweet](https://twitter.com/share) [![Auth Series #4 - Call ASP.NET Core API Protected By Azure AD/Microsoft Entra ID via Console App Using Device Code Flow](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-16_15h57_24.png)](https://uptec.io/blog/auth-series-4-call-protected-api-by-azure-ad-microsoft-entra-id-via-console-device-code-flow) 4 min read #### [Auth Series #4 - Call ASP.NET Core API Protected By Azure AD/Microsoft Entra ID via Console App Using Device Code Flow](https://uptec.io/blog/auth-series-4-call-protected-api-by-azure-ad-microsoft-entra-id-via-console-device-code-flow) [Mirza Ghulam Rasyid](https://uptec.io/blog/author/mirza-ghulam-rasyid) : Dec 8, 2023, 1:32:00 PM Auth Series #4 - Call ASP.NET Core API Protected By Azure AD/Microsoft Entra ID via Console App Using Device Code Flow This is the 4th tutorial of... [Read More](https://uptec.io/blog/auth-series-4-call-protected-api-by-azure-ad-microsoft-entra-id-via-console-device-code-flow) [![Auth Series #3 - Call ASP.NET Core API Protected by Azure AD/Microsoft Entra ID via Console Client Credentials Flow](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-14_10h35_32.png)](https://uptec.io/blog/auth-series-3-call-azure-ad-microsoft-entra-id-protected-api-via-console-client-credentials-flow) 3 min read #### [Auth Series #3 - Call ASP.NET Core API Protected by Azure AD/Microsoft Entra ID via Console Client Credentials Flow](https://uptec.io/blog/auth-series-3-call-azure-ad-microsoft-entra-id-protected-api-via-console-client-credentials-flow) [Mirza Ghulam Rasyid](https://uptec.io/blog/author/mirza-ghulam-rasyid) : Dec 8, 2023, 1:32:00 PM Auth Series #3 - Call ASP.NET Core API Protected by Azure AD/Microsoft Entra ID via Console Client Credentials Flow This is the 3rd tutorial of the ... [Read More](https://uptec.io/blog/auth-series-3-call-azure-ad-microsoft-entra-id-protected-api-via-console-client-credentials-flow) [![Auth Series #2 - Protect ASP.NET Core Api with Microsoft Entra ID and Access It via Postman](https://uptec.io/hubfs/Imported_Blog_Media/2024-01-11_17h42_18.png)](https://uptec.io/blog/auth-series-2-protect-api-with-azure-entra-id-and-access-it-via-postman) 4 min read #### [Auth Series #2 - Protect ASP.NET Core Api with Microsoft Entra ID and Access It via Postman](https://uptec.io/blog/auth-series-2-protect-api-with-azure-entra-id-and-access-it-via-postman) [Mirza Ghulam Rasyid](https://uptec.io/blog/author/mirza-ghulam-rasyid) : Dec 8, 2023, 1:32:00 PM Auth Series #2 - Protect ASP.NET Core Api with Microsoft Entra ID and Access It via Postman This is the 2nd tutorial of the Auth Series. In this... [Read More](https://uptec.io/blog/auth-series-2-protect-api-with-azure-entra-id-and-access-it-via-postman) ##### Australia Australia 77 Cinnamon Meander Two Rocks, WA 6037, Australia ABN: 48 643 822 833 ##### Europe Europe Margote Wichelen 9260, Belgium ##### New Zealand New Zealand Suite A Floor 8 Harbourview Building, 152 Quay Street Auckland Central 1010, New Zealand  NZBN: 9429051226893 ##### About About Uptec acknowledges the Traditional Owners of Country throughout Australia and acknowledges their continuing connection to land, waters and community. We pay our respects to the people, the cultures and the Elders past and present.     © 2026 Uptec Pty Ltd [Linkedin](https://au.linkedin.com/company/uptecio) Return to top ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mirza Ghulam Rasyid", "url" : "https://uptec.io/blog/author/mirza-ghulam-rasyid" }, "dateModified" : "2024-12-08T02:36:34.442Z", "datePublished" : "2023-12-08T02:32:00.000Z", "headline" : "Auth Series #6 - Secure Open API (Swagger) calls with Microsoft Entra ID/Azure AD", "image" : [ "https://uptec.io/hubfs/Imported_Blog_Media/2024-01-27_00h14_22.png" ], "mainEntityOfPage" : { "@id" : "https://uptec.io/blog/auth-series-6-secure-open-api-swagger-calls-with-microsoft-entra-id-azure-ad", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://uptec.io/hubfs/Logo.jpg" } } } ```