相反，文档建议使用 Identity Server、Azure AD 等来保护 Web API。据我所知，Identity 也提供 JWT，那么为什么不推荐呢？
以下是推荐 Identity Server 和 Azure AD 的文档的链接（https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-6.0&tabs=visual-studio#： ~:text=To%20secure%20web%20APIs%20and%20SPAs%2C%20use%20one%20of%20the%20following%3A