ASP.NET Core Web API not authenticating with Identity cookies from Blazor Server app

I imagine that your scenario involves a Blazor Server application and a WebAPI that share business logic and functionality, but the Blazor app handles the UI while the WebAPI is dedicated to other external clients.

In my experience, the best way to authenticate the APIs is using a bearer token.

I suggest you modify the Program.cs file like this:

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new()
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = configuration["Jwt:Issuer"],
            ValidAudience = configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["Jwt:Key"]!)),
        };
    });

And add an authentication endpoint:

[HttpPost("login")]
public async Task<IActionResult> Login(string email, string password)
{
    var result = await _identityService.LoginAsync(email, password);
    return result.IsSuccess ? Ok(result.Value) : Unauthorized(result.Errors);
}

To perform the login, add a service with the following logic:

public async Task<LoginResponseDto> LoginAsync(string email, string password, CancellationToken cancellationToken = default!)
{
    var user = await _userManager.FindByEmailAsync(email);
    if (user == null)
        return LoginResponseDto.Failure("Invalid credentials");

    var result = await _signInManager.CheckPasswordSignInAsync(user, password, false);
    if (!result.Succeeded)
        return LoginResponseDto.Failure("Invalid credentials");

    var accessToken = _jwtTokenGenerator.GenerateAccessToken(user);
    var refreshToken = _jwtTokenGenerator.GenerateRefreshToken();
    return LoginResponseDto.Success(user.Id, accessToken, refreshToken);
}

And a token generator service with a function like this:

public string GenerateAccessToken(ApplicationUser user)
{
    var jwtSettings = _configuration.GetSection("Jwt");

    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSettings["Key"]!));
    var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

    var claims = new List<Claim>
    {
        new(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
        new(JwtRegisteredClaimNames.Email, user.Email!),
        new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
    };

    // Optional: Add roles
    // claims.Add(new Claim(ClaimTypes.Role, "Admin")); 

    var token = new JwtSecurityToken(
        issuer: jwtSettings["Issuer"],
        audience: jwtSettings["Audience"],
        claims: claims,
        expires: DateTime.UtcNow.AddMinutes(int.Parse(jwtSettings["Duration"]!)),
        signingCredentials: creds);

    return new JwtSecurityTokenHandler().WriteToken(token);
}

If you want more security, you can set a short duration for the access token and use a refresh token to renew it on the client side using the following endpoint:

[HttpPost("refresh")]
public async Task<IActionResult> Refresh(string accessToken, string refreshToken)
{
    var response = await _identityService.RefreshTokenAsync(accessToken, refreshToken);
    // Handle response...
}

public async Task<RefreshTokenResponseDto> RefreshTokenAsync(string accessToken, string refreshToken)
{
    var principal = _jwtTokenValidator.ValidateToken(accessToken, validateLifetime: false);
    if (principal == null)
    {
        return RefreshTokenResponseDto.Failure("Invalid access token");
    }
    
    var userId = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    if (userId == null)
    {
        return RefreshTokenResponseDto.Failure("Invalid access token");
    }
    
    var user = await _userManager.FindByIdAsync(userId);
    if (user == null)
    {
        return RefreshTokenResponseDto.Failure("Invalid access token");
    }
    
    var newAccessToken = _jwtTokenGenerator.GenerateAccessToken(user);
    var newRefreshToken = _jwtTokenGenerator.GenerateRefreshToken();

    return RefreshTokenResponseDto.Success(Guid.Parse(userId), newAccessToken, newRefreshToken);
}