title: InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found
body: <p>We have a Net Core 2.1 API project. We use the request headers to retrieve API key which we check against our database to see if it matches one of the expected keys. If it does then we allow the request to continue, otherwise we want to send back Unauthorized response. </p>
  
  <p>our startup.cs</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
              {
                  options.AddPolicy("APIKeyAuth", policyCorrectUser =&gt;
                  {
                      policyCorrectUser.Requirements.Add(new APIKeyAuthReq());
                  });
  
              });
  services.AddSingleton&lt;Microsoft.AspNetCore.Authorization.IAuthorizationHandler, APIKeyAuthHandler&gt;();
  </code></pre>
  
  <p>Our APIKeyAuthHandler.cs</p>
  
  <pre><code>public class APIKeyAuthReq : IAuthorizationRequirement { }
  
      public class APIKeyAuthHandler : AuthorizationHandler&lt;APIKeyAuthReq&gt;
      {
          protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, APIKeyAuthReq requirement)
          {
              if (context == null)
                  throw new ArgumentNullException(nameof(context));
              if (requirement == null)
                  throw new ArgumentNullException(nameof(requirement));
  
              var httpContext = context.Resource as Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext;
  
              var headers = httpContext.HttpContext.Request.Headers;
              if (headers.TryGetValue("Authorization", out Microsoft.Extensions.Primitives.StringValues value))
              {
                  using (DBContext db = new DBContext ())
                  {
                      var token = value.First().Split(" ")[1];
                      var login = db.Login.FirstOrDefault(l =&gt; l.Apikey == token);
                      if (login == null)
                      {
                          context.Fail();
                          httpContext.HttpContext.Response.StatusCode = 403;
                          return Task.CompletedTask;
                      } else
                      {
                          httpContext.HttpContext.Items.Add("CurrentUser", login);
                          context.Succeed(requirement);
                          return Task.CompletedTask;
                      }
                  }
              }
          }
      }
  </code></pre>
  
  <p>and our controller.cs</p>
  
  <pre><code>    [Route("api/[controller]/[action]")]
      [Authorize("APIKeyAuth")]
      [ApiController]
      public class SomeController : ControllerBase
      {
      }
  </code></pre>
  
  <p>Everything works fine when a valid key exists but when it doesnt, there is a 500 internal error thrown for No authenticationScheme instead of 403.</p>
  
  <p>We are relatively new to net core (coming from Net Framework/Forms Authentication) so if there is more accurate way of doing this sort of auth, please let me know. </p>
  
  <p>Error Message:</p>
  
  <blockquote>
    <p>InvalidOperationException: No authenticationScheme was specified, and
    there was no DefaultChallengeScheme found.
    Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext
    context, string scheme, AuthenticationProperties properties)</p>
  </blockquote>