I have a .NET application with a web API, a SignalR hub, and a BackgroundService, everything in the same project, and additionally a SPA that consumes this web API.

I don’t understand how my BackgroundService should generate a token when connecting to the SignalR hub. Many code examples I’ve found on GitHub simply get a token from appSettings.json, but I’m sure that’s not how it should be done. Should my application be a confidential client application, acquiring a token from the Microsoft identity platform by sharing client credentials (a secret)?

Program.cs

//...

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

// Handle hub authorization
builder.Services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
{
    options.Events = new JwtBearerEvents
    {
        OnMessageReceived = context =>
        {
            var accessToken = context.Request.Query["access_token"];
            var path = context.HttpContext.Request.Path;
            if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/hubs"))
            {
                context.Token = accessToken;
            }
            return Task.CompletedTask;
        },
    };
});

//...

builder.Services.AddSignalR();
builder.Services.AddHostedService<Worker>();

//...

app.MapHub<ChannelHub>("/hubs/channel");

ChannelHub.cs

[Authorize]
public class ChannelHub : Hub<IChannel>
{
    public async Task SendMessage(Message message)
    {
        await Clients.All.ReceiveMessage(message);
    }
}

Worker.cs

public class Worker : BackgroundService
{
    private readonly HubConnection _connection;

    public Worker()
    {
        _connection = new HubConnectionBuilder()
            .WithUrl("https://localhost:5032/hubs/channel",
                options => options.AccessTokenProvider = () => Task.FromResult("")!) // how should I generate a token?
            .WithAutomaticReconnect()
            .Build();

        // ...
    }

    protected override async Task ExecuteAsync(CancellationToken cancellationToken)
    {
        await _connection.StartAsync(cancellationToken); // 401

        // ...

        await _connection.InvokeAsync("SendMessage", message);
    }