Securing API using OIDC Resoource server - asp.net-core

Question

I have 2 .NET solutions: a webapp, an API.
When user browses the webapp he needs to be authenticated and thus facing this:
return builder.AddOpenIdConnect("contonso", options =>
{
options.Authority = configuration["Contonso:Oidc:Authority"];
options.ClientId = configuration["Contonso:Oidc:ClientId"];
options.ClientSecret = configuration["Contonso:Oidc:ClientSecret"];
options.ResponseType = OpenIdConnectResponseType.Code;
options.ProtocolValidator.RequireState = true;
options.UsePkce = false;
options.SaveTokens = true;
options.GetClaimsFromUserInfoEndpoint = true;
}
Which works finely as I get all infos : code, token, id_token once user authenticated.
I copied code above into my API and changed clientId/clientSecret to point to my resource server.
From my webapp I call the API adding an Authorization : Bearer token (received previously).
However in API solution, I get redirected each time to the login page, whatever I pass in my authorization header.
Do I need to change something in my API code in order to make the token "transit" to the resource server and just validate token received?
Cheers,

Answer 1

APIs behave differently to web back ends. The API should never redirect the client and should just validate JWT access tokens instead:
Return a 200 error when the JWT is valid
Return a 401 error when it is not
You use different .Net middleware in the API, by calling AddJwtBearer. Here is a Curity code example that does this.
The main thing is to implement the standards based behaviour, which will then work with any programming language and Authorization Server.
API CODE
There are two main approaches to API JWT validation, and you are using the first type:
Use a JWT framework (such as ASP.Net Core)
Use a JWT library
When you are new to securing APIs using OAuth, it can be useful to understand what code looks like for the library approach, as in this class of mine, which shows the steps an API should use:
Download the token signing public key from the Authorization Server
Give the public key to a library, which will then cryptographically validate the JWT
Also check the issuer, audience and algorithm are as expected
.Net Core will do this for you automatically though, so use the Curity code example approach, since you will write less code.

Answer 2

As always RTFM was the good way. I needed to call the introspection endpoint to validate my token. Explained here also : https://connect2id.com/products/server/docs/api/token-introspection
I then used a Nuget package doing that and it works fine.
Anyways thanks for your help and lightning Gary :)