.NET API Authentication Automation

I’m enhancing my existing .NET API and want the entire user-authentication flow fully automated with a clean, token-based approach. The goal is simple: when a client signs in, a secure token is issued; every subsequent request is validated against that token, and any call made without it is instantly rejected.

What I need from you:
• Wire up token generation and validation directly inside the API pipeline—think middleware or attribute-based filters, whichever is cleaner for this codebase.
• Expose login and refresh endpoints that hand out, verify, and renew tokens without manual steps.
• Protect a sample controller action so I can see the authorization filter in action.
• Hand over concise setup notes or inline comments so I can extend the pattern across the rest of the project.

Everything should be written in idiomatic C# with current .NET best practices—dependency injection, async calls, and clear separation of concerns. A short postman collection or curl examples proving success (200) and failure (401/403) responses will serve as acceptance criteria. If you already favour JWT, perfect—just keep the implementation flexible so I can swap standards later if needed.