title: Use both OpenIdConnect and JWT Bearer Token with Microsoft Identity Web ASP.NET Core 3.1
body: <p>I want to provide the ability for someone to access my API in a browser using OpenIdConnect or using the OAuth 2.0 authorization code flow using a bearer token. This is similar functionality that I see with Microsoft D365 OData endpoints. I can access them via a browser but they require user authentication, or I can access them via an HTTP GET with a bearer token.</p>
  
  <p>If I configure the Web API like this:</p>
  
  <pre><code>services.AddProtectedWebApi(this.Configuration).
  AddSignIn(this.Configuration);
  </code></pre>
  
  <p>I can access the GET API from the browser and if I am not already authenticated it will prompt me for my credentials and authenticate me. However, if I attempt to access the same API from Postman with a bearer token it returns a web page for authentication.</p>
  
  <p>If I configure the Web API like this:</p>
  
  <pre><code>services.AddProtectedWebApi(this.Configuration);
  </code></pre>
  
  <p>I get a 401 error in the browser but I am able to access the API from Postman with a bearer token. </p>
  
  <p>I would like to be able to use the bearer token if it is provided and otherwise challenge for user credentials.</p>
  
  <p>My Controller users <code>[Authorize]</code> and I am currently not using any validation in the GET action. I am letting the middleware do all the validation.</p>