# .NET Core 2 and JS **URL:** \ **Category:** JWT.io\ **Created:** [September 12, 2018, 7:08pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374 "2018-09-12T19:08:43Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Tomasz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tomasz/32/8681_2.png) [@Tomasz](https://community.auth0.com/u/Tomasz)\ **Post date:** [September 12, 2018, 7:08pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/1 "2018-09-12T19:08:43Z")
Hello guys. I tried to create .NET Core 2 app which uses only REST API. To consume this API I want to use Vanila JS or Jquery. I played around with a sample app: “[ASP.NET](http://ASP.NET) Core v2.0: Login” (in github: auth0-aspnetcore-webapi-samples/tree/master/Quickstart) and with a sample app “JavaScript: Login” (in github auth0-javascript-samples). But without success :(. I want on UI get JWT token from [Auth0.com](http://Auth0.com). I think that I should be transferred to [Auth0.com](http://Auth0.com) site and log in there. Then go back to my site with JWT token. After that, I want to call my API with the token to Authorize this call. Can you suggest me how I can do it? Some links or anything like that? The other idea is to call REST API. UI I’ll sent as params login and password. Then the method will call Auth0. Auth0 will return to app JWT token. The app will return JWT token to UI. UI will save token and every time when I’ll call any API method I’ll use that JWT token. If those approaches are wrong, please tell me what is a proper way of doing that stuff? I want to also say that I want to be able to test that solution with Postman :). Thanks :). ---
**Author:** ![kimcodes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kimcodes/32/81052_2.png) [@kimcodes](https://community.auth0.com/u/kimcodes)\ **Post date:** [September 14, 2018, 1:36pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/3 "2018-09-14T13:36:16Z")
👋 @Tomasz let’s see what we can do! Your approach sounds correct. What kind of application do you have? If it’s a single page application there is a short intro here on them [Single Page Applications](https://auth0.com/docs/applications/spa) and as you mentioned the JavaScript Login is a good one (the guide can be found here: [Auth0 JavaScript SDK Quickstarts: Login](https://auth0.com/docs/quickstart/spa/vanillajs) When you played around the sample did you also follow the guide for the Quickstart guide (here: [Auth0 ASP.NET Core Web API SDK Quickstarts: Authorization](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi))? > **[Auth0 ASP.NET Core Web API SDK Quickstarts: Authorization](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi)** > > This tutorial demonstrates how to add authorization to an ASP.NET Core Web API application using the standard JWT middleware. You said you tried but without success. What happened when you tried these applications? Where did things not work. What happened and what did you expect to happen? And we can see how to fix any issues that came up. For the [ASP.NET](http://ASP.NET) Core API quickstart is broken down as you create/define your api in Auth0 as described [here](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi#create-an-api) followed by [defining your scopes](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi#define-scopes). There’s [steps to configure the sample project](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi#configure-the-sample-projec) and how to [validate the `access token`](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi#validate-access-tokens). and then here describes how to use your API: [Auth0 ASP.NET Core Web API SDK Quickstarts: Using your API](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi/02-using). There are also some steps on [troubleshooting](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi/03-troubleshooting) that includes checking the token validation, inspecting a token, and debugging. ---
**Author:** ![Tomasz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tomasz/32/8681_2.png) [@Tomasz](https://community.auth0.com/u/Tomasz)\ **Post date:** [September 19, 2018, 2:46pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/4 "2018-09-19T14:46:20Z")
Hey @kimcodes! I’ll do all my steps once again for you :). So… I downloaded the sample for jQuery. I can log in within [auth0.com](http://auth0.com) nice and smooth :). Then I download the sample [ASP.NET](http://ASP.NET) Core Web API v2.0: Authorization. I kicked off. I went to site: [http://localhost:3010/api/public](http://localhost:3010/api/public) and I can see: {“message”:“Hello from a public endpoint! You don’t need to be authenticated to see this.”}. A token which I’ll use I took from localStorage.id\_token. I tried to go to the site: [http://localhost:3010/api/private](http://localhost:3010/api/private). I saw: This page isn’t working. If the problem continues, contact the site owner. HTTP ERROR 401 I ran Postman: Get: [http://localhost:3010/api/private](http://localhost:3010/api/private) Authorisation Type: Bearer Token (localStorage.id\_token token from there) I send a request. I got 401 Unauthorized ---
**Author:** ![kimcodes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kimcodes/32/81052_2.png) [@kimcodes](https://community.auth0.com/u/kimcodes)\ **Post date:** [September 19, 2018, 3:02pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/5 "2018-09-19T15:02:44Z")
Thanks so much for outlining the steps for me! Let’s take a look. I believe we will need to pass the `access token` instead of the `id token` , can you give that a shot and see what you get back? ---
**Author:** ![Tomasz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tomasz/32/8681_2.png) [@Tomasz](https://community.auth0.com/u/Tomasz)\ **Post date:** [September 21, 2018, 2:40pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/6 "2018-09-21T14:40:13Z")
So: ![image](https://global.discourse-cdn.com/auth0/original/2X/2/203275e45b8bb4cdabfa9a6fe860afb3740dfce6.png) I did try access\_token. and id\_token in Postman. Same results: Unauthorized. ![image](https://global.discourse-cdn.com/auth0/original/2X/0/0b483882a73b932911172bfce01b2270431fee16.png) ---
**Author:** ![kimcodes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kimcodes/32/81052_2.png) [@kimcodes](https://community.auth0.com/u/kimcodes)\ **Post date:** [September 24, 2018, 4:52pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/7 "2018-09-24T16:52:30Z")
Looks like your access token might be opaque (you can check your token at [https://jwt.io/](https://jwt.io/)). Usually an `opaque` token means that the token was not requested for a particular audience. Does the request have an `audience` value in the payload? (It would need to be the API identifier as the value if that is what you are trying to call.) ---
**Author:** ![Tomasz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tomasz/32/8681_2.png) [@Tomasz](https://community.auth0.com/u/Tomasz)\ **Post date:** [September 26, 2018, 11:04am UTC](https://community.auth0.com/t/net-core-2-and-js/15374/8 "2018-09-26T11:04:11Z")
Hey Kim. Probably I did something wrong with my configuration. Can you take a look at that? Thanks :). I check id\_token: [mod edit: private info included] . For access\_token: [mod edit: private info included] . My auth0-variables.js: [mod edit: private info included] . In my c# app: [mod edit: private info included] Applications: [mod edit: private info included] APIs: [mod edit: private info included] Auth0 Managment API: [mod edit: private info included] Muzyczni: [mod edit: private info included] ---
**Author:** ![kimcodes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kimcodes/32/81052_2.png) [@kimcodes](https://community.auth0.com/u/kimcodes)\ **Post date:** [October 1, 2018, 9:30pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374/9 "2018-10-01T21:30:23Z")
The invalid signature is that what you get when you copy/paste the access token ? The API Authorization expects a JWT which only happens if the `audience` parameter is passed when authorizing from the client side. When `audience` parameter must be set to the API’s Audience parameter. Have you specified the audience? ---
**Author:** ![jerdog](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerdog/32/11231_2.png) [@jerdog](https://community.auth0.com/u/jerdog)\ **Post date:** [January 22, 2019, 12:00am UTC](https://community.auth0.com/t/net-core-2-and-js/15374/10 "2019-01-22T00:00:01Z")
This topic was automatically closed after 14 days. New replies are no longer allowed.