Modern aspnetcore Web APIs are relatively easy to protect using Bearer Tokens issued by Duende IdentityServer. But there is a lot of legacy .NET framework