Finally, it looks like API security in ASP.NET will be simple, yet extensible out of the Visual Studio Box. With Visual Studio 2019, IdentityServer4 is included right in the templates. The default configuration is convention based and only requires a couple of lines of code to work. Yet it is the same powerful flexible IdentityServer as we know - with all the extensibility options available.