title: Authorization for JWT bearer in Swashbuckle .NET Core 2
body: <p>I use tokens generated by an authentication service for my app. No problems there. Now I have introduced Swashbuckle to document my API an I can authenticate as follows by sending the JWT with every request using this code;</p>
  
  <pre><code>services.AddSwaggerGen(c =&gt;
  {
      var a = new ApiKeyScheme();
      //c.AddSecurityDefinition("Bearer", new ApiKeyScheme()
      //{ In = "header", Description = "Please insert JWT with Bearer into field", Name = "Authorization", Type = "apiKey" });
  
      c.OperationFilter&lt;AuthorizationHeaderParameterOperationFilter&gt;();
  
      c.SwaggerDoc("v2", new Info
      {
          Version = "v2",
          Title = "MyTitle",
          Description = "An interface for ...",
          TermsOfService = "None",
          Contact = new Contact() { Name = "MyApp", Email = "a@example.com", Url = "www.example.com" }
      });
      // Set the comments path for the Swagger JSON and UI.
      var basePath = AppContext.BaseDirectory;
      var xmlPath = Path.Combine(basePath, "cpDataCore.xml");
      c.IncludeXmlComments(xmlPath);
  });
  
  public class AuthorizationHeaderParameterOperationFilter : IOperationFilter
  {
      public void Apply(Operation operation, OperationFilterContext context)
      {
          var filterPipeline = context.ApiDescription.ActionDescriptor.FilterDescriptors;
          var isAuthorized = filterPipeline.Select(filterInfo =&gt; filterInfo.Filter).Any(filter =&gt; filter is AuthorizeFilter);
          var allowAnonymous = filterPipeline.Select(filterInfo =&gt; filterInfo.Filter).Any(filter =&gt; filter is IAllowAnonymousFilter);
  
          if (isAuthorized &amp;&amp; !allowAnonymous)
          {
              if (operation.Parameters == null)
                  operation.Parameters = new List&lt;IParameter&gt;();
  
              operation.Parameters.Add(new NonBodyParameter
              {
                  Name = "Authorization",
                  In = "header",
                  Description = "access token",
                  Required = true,
                  Type = "string"
              });
          }
      }
  }
  </code></pre>
  
  <p>Which gives me the following header - as expected</p>
  
  <pre><code>accept:application/json
  Accept-Encoding:gzip, deflate, br
  Accept-Language:en-AU,en;q=0.9
  Authorization:Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9naXZlbm5hbWUiOiJEZW5uaXMiLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9zdXJuYW1lIjoiR2FzY29pZ25lIiwiaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSI6ImRlbm5pc2ciLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9zaWQiOiI1NCIsIlJlZnJlc2hUb2tlbiI6IjY5OTA1NTFmLTNhOTQtNDVmYi1hYjc2LTZlOTQyNGE3NjJmOCIsIkFsbERhdGFSZWFkT25seUZvckFwcHJvdmVycyI6IlRydWUiLCJQcm9qZWN0SUQiOiI2IiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjoic3lzYWRtaW4iLCJuYmYiOjE1MTk2MzY2NDIsImV4cCI6MTUxOTYzODQ0MiwiaXNzIjoiaHR0cHM6Ly9kYXRhLmNpdmlscHJvc29mdHdhcmUuY29tLyIsImF1ZCI6Imh0dHBzOi8vcm1zLmNpdmlscHJvc29mdHdhcmUuY29tLyJ9.nBEZgzcmZVGhFJmKI8u7p7g7xPU13HEAGJu_lrWylnc
  Connection:keep-alive
  Cookie:username=demo; jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9naXZlbm5hbWUiOiJUcm95IiwiaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvc3VybmFtZSI6IkVsZGVyIiwiaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZSI6InRyb3kiLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9zaWQiOiI1IiwiUmVmcmVzaFRva2VuIjoiMTNhNzRmNDQtNmVmOC00MDQ3LTlmYWYtOWQ3MzI4MmNhZjQ4IiwiUHJvamVjdElEIjoiLTEiLCJuYmYiOjE1MDUwOTc3MjEsImV4cCI6MTUwNTA5ODYyMSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo2MDAwMC8iLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0OjYwMDAwLyJ9.8You0XiUlvdHb2TRuDzaiXv6r74v7ga1Av_Z3ikmblU
  Host:localhost:60000
  Referer:http://localhost:60000/swagger/
  User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36
  </code></pre>
  
  <p>Although, I am not sure where the Cookie is coming from. That is nothing to do with my code. I just ignore it - so far so good.</p>
  
  <p>The problem is that this means the token has to be entered with every request which is a pain. Ideally, I would want to authenticate using the inbuilt swagger interface - according to several articles, I should be able to do this;</p>
  
  <pre><code>c.AddSecurityDefinition("Bearer", new ApiKeyScheme()
  { In = "header", Description = "Please insert JWT with Bearer into field", Name = "Authorization", Type = "apiKey" });
  </code></pre>
  
  <p>This works fine, and I can add the token, there just seems to be a step I am missing to add the token to the header of every request. If I just add the auth, then this gives me the following header, which of course fails the authentication.</p>
  
  <pre><code>GET /api/ApprovalItemTypes HTTP/1.1
  Host: localhost:60000
  Connection: keep-alive
  accept: application/json
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36
  Referer: http://localhost:60000/swagger/
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-AU,en;q=0.9
  Cookie: username=demo; jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW5_xxx__LTEiLCJuYmYiOjE1MDUwOTc3MjEsImV4cCI6MTUwNTA5ODYyMSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo2MDAwMC8iLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0OjYwMDAwLyJ9.8You0XiUlvdHb2TRuDzaiXv6r74v7ga1Av_Z3ikmblU
  </code></pre>
  
  <p>What else do I need to do in order to get the request to include the token for every subsequent request?</p>