.NET 10 issues with OpenApi

If you want to use Swashbuckle 10.x (not 9.x) and Microsoft.AspNetCore.OpenApi 10.x;

In Swashbuckle 10.x, the method for adding Security Requirements has changed to a "Transformer". Therefore, the Program.cs should be as follows:

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using Microsoft.OpenApi;
using System.Text;

namespace WebApi2
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            builder.Services.AddControllers();

            builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateIssuer = true,
                        ValidateAudience = true,
                        ValidateLifetime = true,
                        ValidateIssuerSigningKey = true,
                        ValidIssuer = builder.Configuration["Jwt:Issuer"],
                        ValidAudience = builder.Configuration["Jwt:Issuer"],
                        IssuerSigningKey = new SymmetricSecurityKey(
                            Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!))
                    };
                });

            builder.Services.AddAuthorization();

            // New Security API for Swashbuckle 10.x
            builder.Services.AddSwaggerGen(options =>
            {
                options.SwaggerDoc("v1", new OpenApiInfo
                {
                    Title = "My Web API",
                    Version = "v1"
                });

                options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
                {
                    Name = "Authorization",
                    Type = SecuritySchemeType.Http,
                    Scheme = "bearer",
                    BearerFormat = "JWT",
                    In = ParameterLocation.Header,
                    Description = "Please enter token"
                });

                // Security Requirement（use Transformer）
                options.AddSecurityRequirement(document =>
                    new OpenApiSecurityRequirement
                    {
                        [new OpenApiSecuritySchemeReference("Bearer", document)] = []
                    });
            });

            var app = builder.Build();

            if (app.Environment.IsDevelopment())
            {
                app.UseSwagger();
                app.UseSwaggerUI(o => o.SwaggerEndpoint("/swagger/v1/swagger.json", "v1"));
            }

            app.UseHttpsRedirection();

            app.UseAuthentication();
            app.UseAuthorization();

            app.MapControllers();

            app.Run();
        }
    }
}

The same result can be obtained.

Hi @Thomas Borby Lancestremère ,

Thanks for reaching out.

From your description, the issue is not with your JWT or Swagger configuration itself, but with a change in the OpenAPI/Swashbuckle packages when moving to .NET 10.

Your code is using types from Microsoft.OpenApi.Models, which worked in earlier versions (such as with Swashbuckle 9.x in .NET 9). In Swashbuckle.AspNetCore 10.x, those OpenAPI types were moved to the Microsoft.OpenApi namespace, which is why you’re now seeing the error that Models does not exist.

Another thing to be aware of is that the .NET 10 Web API template may include Microsoft.AspNetCore.OpenApi by default. This isn’t an issue by itself, but problems can occur if it’s mixed with Swashbuckle-based configuration like AddSwaggerGen.

To fix the issue, I suggest two options depending on how you want to proceed.

If you want to keep your current code as-is, the simplest approach is:

• Remove Microsoft.AspNetCore.OpenApi if you’re not using it
• Install a compatible version of Swashbuckle, for example:

    Swashbuckle.AspNetCore 9.0.6
  

• Keep using:

    using Microsoft.OpenApi.Models;
  

After that, rebuild and navigate to /swagger. The Authorize button should work as expected again.

If you prefer to stay on Swashbuckle 10.x, then you’ll need to update your code to use the new namespace:

using Microsoft.OpenApi;

and ensure your configuration aligns with that version, without mixing it with the built-in OpenAPI setup.

Hope this helps! If my answer was helpful, I would greatly appreciate it if you could follow the instructions here so others with the same problem can benefit as well.

It works in .NET 9, but somehow not in .NET 10?

Please see the statement in the following github article. The statement means that Microsoft.OpenApi.Models is not available in Swashbuckle 10.x.

Migrating to Swashbuckle.AspNetCore v10

"Update any using directives that reference types from the Microsoft.OpenApi.Models namespace to use the new namespace Microsoft.OpenApi."

Swashbuckle 9.x include the Microsoft.OpenApi.Models. That's why "It works in .NET 9."

Therefore, try using the Swashbuckle 9.x. Do not use the Micosoft.AspNerCore.OpenApi to avoid possible conflict if any.

Shown below is working sample:

(1) Install SwaskBukle.AspNetCore 9.0.6. Uninstall Microsoft.OpenApi.Models if any.

(2) Program.cs

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using Microsoft.OpenApi.Models;
using System.Text;

namespace WebApi
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            // Add services to the container.

            builder.Services.AddControllers();

            // Resister authentication services with JWT Bearer
            builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateIssuer = true,
                        ValidateAudience = true,
                        ValidateLifetime = true,
                        ValidateIssuerSigningKey = true,
                        ValidIssuer = builder.Configuration["Jwt:Issuer"],
                        ValidAudience = builder.Configuration["Jwt:Issuer"],
                        IssuerSigningKey = new SymmetricSecurityKey(
                            Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!))
                    };
                });

            // Register authorization services
            builder.Services.AddAuthorization();

            // Swagger / OpenAPI (Swashbuckle) with Bearer auth
            builder.Services.AddSwaggerGen(options =>
            {
                options.SwaggerDoc("v1", new OpenApiInfo
                {
                    Title = "My Web API",
                    Version = "v1"
                });

                options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
                {
                    Name = "Authorization",

                    // Use baerer token authorization header
                    Type = SecuritySchemeType.Http,

                    Scheme = "Bearer",
                    BearerFormat = "JWT",
                    In = ParameterLocation.Header,
                    Description = "Please enter token",
                });

                options.AddSecurityRequirement(new OpenApiSecurityRequirement
                {
                    {
                        new OpenApiSecurityScheme
                        {
                            Reference = new OpenApiReference
                            {
                                Type = ReferenceType.SecurityScheme,
                                Id = "Bearer"
                            }
                        },
                        new List<string>()
                    }
                });
            });

            var app = builder.Build();

            if (app.Environment.IsDevelopment())
            {
                app.UseSwagger();

                // Enabling Swagger UI
                app.UseSwaggerUI(options =>
                {
                    options.SwaggerEndpoint("/swagger/v1/swagger.json", "v1");
                });
            }

            app.UseHttpsRedirection();

            // Enable authentication and authorization middleware
            app.UseAuthentication();

            app.UseAuthorization();

            app.MapControllers();

            app.Run();
        }
    }
}

(3) Result

Initial display

Note that [Authorize] button appears as expected.

Windows to input token

This is shown on [Authorize] button click.