---
title: Register Edge API auth services
summary: Registers JWT-bearer-only authentication for external/Edge APIs.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.ServiceExtensions
reference_type: package
operation_id: OP-04
trigger: EdgeAPIStartup (or a consumer) calls RegisterEdgeAPIAuthServices() during service configuration.
---

# Register Edge API auth services

This operation registers JWT-bearer authentication for external-facing/Edge APIs, which never accept Windows/Negotiate authentication. It is used by [Core and Edge API startup](core-and-edge-api-startup.md) for `EdgeAPIStartup`.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-04 |
| **Trigger** | `EdgeAPIStartup.ConfigureServices` (or an application) calls `RegisterEdgeAPIAuthServices()`. |
| **Inputs** | None (parameterless). |
| **Outputs** | JWT bearer authentication is registered and made the default scheme. |
| **Primary components** | `IServiceCollectionExtensions.RegisterEdgeAPIAuthServices` |
| **Entry point** | `src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/IServiceCollectionExtensions.cs` (L99–110) |

## Steps

1. `ConfigureOptions<ConfigureJwtBearerOptions>()` ([BR-SE-06](../business-rules.md#br-se-06-edge-apis-authenticate-with-jwt-bearer-only))

   > **Origin**: This registers an `IConfigureOptions<JwtBearerOptions>` implemented by [`Configure JWT bearer options`](../../saif-netcore-authservice/operations/configure-jwt-bearer-options.md) (`SAIF.NetCore.AuthService`); the configurator itself does not run now — it runs later, the first time the framework resolves `JwtBearerOptions` for a request.
2. `AddTokenIdentityService()` registers Singleton `ISecurityClient → SecurityClient`, Scoped `IIdentityService → TokenIdentityService`, Transient `IIdentityServiceAccessor → IdentityServiceAccessor`.

   > **Origin**: These types' identity-resolution logic is implemented in [`Resolve the current identity service`](../../saif-netcore-authservice/operations/resolve-the-current-identity-service.md) (`SAIF.NetCore.AuthService`); this step only registers them in the container — resolution runs later, per request, when a consumer injects `IIdentityServiceAccessor`.
3. `AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer()` ([BR-SE-06](../business-rules.md#br-se-06-edge-apis-authenticate-with-jwt-bearer-only))

   > **Origin**: This registers the JwtBearer authentication handler (`Microsoft.AspNetCore.Authentication.JwtBearer`), the same handler configured by [`Register authentication services`](../../saif-netcore-authservice/operations/register-authentication-services.md) (`SAIF.NetCore.AuthService`); token validation itself runs later, per incoming request, not during this registration call.

## Process flow

This diagram shows the one-time DI registration work performed when `RegisterEdgeAPIAuthServices()` is called during service configuration, not the per-request JWT validation that runs afterward.

```mermaid
flowchart TD
    Start([RegisterEdgeAPIAuthServices called]) --> S1[Configure JWT bearer options]
    S1 --> S2[Register token identity service]
    S2 --> S3[Add JwtBearer as default scheme]
    S3 --> EndOk([Edge API JWT-only authentication ready])
```

## Failure and edge-case behavior
- No branching logic; registration always completes once called. Invalid JWT tokens at request time are rejected by the ASP.NET Core authentication middleware per `ConfigureJwtBearerOptions`.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/IServiceCollectionExtensions.cs`