ASP.NET Core JWT Bearer: Set the Metadata Backchannel Proxy

Use BackchannelHttpHandler before retrieval begins, unless a complete client or custom configuration manager already owns that transport.

An API can receive a bearer token and fail on the server's metadata/signing-key download. Configure that JWT bearer scheme after its existing registration and before requests:

using System.Net;
using Microsoft.AspNetCore.Authentication.JwtBearer;

builder.Services.Configure<JwtBearerOptions>(
    JwtBearerDefaults.AuthenticationScheme, options =>
    {
        options.BackchannelHttpHandler = new HttpClientHandler
        {
            UseProxy = true,
            Proxy = new WebProxy("http://proxy.example:8080")
        };
    });

Match the registered name; use its actual name instead of default Bearer when different. Preserve Authority, Audience and the existing token parameters. A public metadata/signing-key endpoint can use a candidate from the HTTP proxy list for this no-account WebProxy URL when public-proxy access is permitted.

In the standard setup, post-configuration creates the backchannel from this handler. If a complete Backchannel or custom ConfigurationManager already supplies the retriever, configure that object instead. The handler property does not override both.

Set any proxy account on WebProxy before use, not by changing Proxy inside SendAsync. Keep issuer, audience, signature, lifetime and additional validators. OIDC login and separate token acquisition retain their own HTTP paths.

Related articles