For example, if you pass in a Basic Auth header, then you can use an action attribute to handle the authorization. An article about it https://codeburst.io/adding-basic-authentication-to-an-asp-net-core-web-api-project-5439c4cf78ee