Most use the JwtBearer authentication handler in ASP.NET Core to secure our APIs. But what does it actually do? What makes it tick? What security and reliability considerations should we be aware of when we go to production? And finally, are there any changes in .NET 7? In this presentation, we will try to bring clarity to these questions.