ASPNET JWT Multi-Tenant Authentication — Tenant-Aware JWT in .NET

public class MultiTenantJwtBearerEvents : JwtBearerEvents
{
    private readonly ITenantService _tenantService;
    public MultiTenantJwtBearerEvents(ITenantService tenantService) => _tenantService = tenantService;

    public override async Task TokenValidated(TokenValidatedContext context)
    {
        var tenantId = context.Principal?.FindFirst("tenant_id")?.Value;
        if (string.IsNullOrEmpty(tenantId))
        {
            context.Fail("Missing tenant claim");
            return;
        }
        var tenant = await _tenantService.GetTenantAsync(tenantId);
        if (tenant is null || !tenant.IsActive)
        {
            context.Fail("Tenant not found or inactive");
            return;
        }
        context.HttpContext.Items["Tenant"] = tenant;
    }
}

// Registration
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.EventsType = typeof(MultiTenantJwtBearerEvents);
    });