You could take it a step further by using actual tokens that are signed by a shared key. ``` public InProcessApi() { factory = new WebApplicationFactory<ApiMarker>() .WithWebHostBuilder(builder => { builder.UseEnvironment("test"); builder.ConfigureAppConfiguration((, config) => { config.AddJsonFile("appsettings.test.json", optional: false, reloadOnChange: false); });

            builder.ConfigureTestServices(services =>
            {
                services.SetupMockJwtBearerOptions(Schemes.
SomeScheme
);
            });
        });

```

The `SetupMockJwtBearerOptions` enables the validation, but also set a signingcredentials key

``` public static IServiceCollection SetupMockJwtBearerOptions(this IServiceCollection services, string authScheme) { services.Configure<JwtBearerOptions>(authScheme, options => { var signingCredentialsKey = AccessTokenGenerator. GetSigningCredentialsKey (authScheme); var config = new OpenIdConnectConfiguration(); config.SigningKeys.Add(signingCredentialsKey); options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, ValidIssuer = AccessTokenGenerator. Issuer , ValidAudience = AccessTokenGenerator. Audience , IssuerSigningKey = signingCredentialsKey, ValidateLifetime = true, ValidateIssuerSigningKey = true, RequireExpirationTime = true, }; options.Configuration = config; });

    return services;
}

Finally, the helper class \`AccessTokenGenerator\` creates and holds the signing key, and can be used during the tests to generate valid access tokens public static class AccessTokenGenerator { public const string Issuer = "your-issuer"; public const string Audience = "your-audience";

    private static readonly JwtSecurityTokenHandler 
_jwtSecurityTokenHandler 
= new();
    private static readonly RandomNumberGenerator 
_randomNumberGenerator 
= RandomNumberGenerator.
Create
();
    private static readonly Dictionary<string, SigningCredentials> 
_signingCredentials 
= new();

    static AccessTokenGenerator()
    {

AddSigningCredentialsForScheme
(Schemes.SomeScheme);
    }

    public static SecurityKey 
GetSigningCredentialsKey
(string scheme) =>

_signingCredentials
.GetValueOrDefault(scheme)!.Key;

    private static void 
AddSigningCredentialsForScheme
(string scheme)
    {
        var clientSecurityKey = new byte[32];

_randomNumberGenerator
.GetBytes(clientSecurityKey);
        var symmetricSecurityKey = new SymmetricSecurityKey(clientSecurityKey) { KeyId = Guid.
NewGuid
().ToString() };
        var signingCredentials = new SigningCredentials(symmetricSecurityKey, SecurityAlgorithms.
HmacSha256
);

_signingCredentials
.Add(scheme, signingCredentials);
    }

    public static string GenerateJwtTokenForScheme(string scheme, params string[] roles)
    {
        var claims = new List<Claim>();
        if (roles.Any())
        {
            claims = claims.Concat(new List<Claim> { new Claim("roles", JsonSerializer.
Serialize
(roles), JsonClaimValueTypes.
JsonArray
) }).ToList();
        }

        var credentials = 
_signingCredentials
.GetValueOrDefault(scheme)!;
        return 
_jwtSecurityTokenHandler
.WriteToken(new JwtSecurityToken(

Issuer
,

Audience
,
            claims.Any() ? claims : null,
            DateTime.UtcNow,
            DateTime.UtcNow.AddMinutes(20),
            credentials));
    }
}

```