6.7 Try it

dotnet run --urls http://localhost:5080

Ordering without signing in is refused:

curl -i -X POST http://localhost:5080/orders -H 'Content-Type: application/json' \
  -d '{"paymentToken":"tok_visa","lines":[{"sku":"MUG","quantity":1}]}'

HTTP/1.1 401 Unauthorized

ADA=$(curl -s http://localhost:5080/dev/token/ada)
curl -X POST http://localhost:5080/orders -H "Authorization: Bearer $ADA" \
  -H 'Content-Type: application/json' \
  -d '{"paymentToken":"tok_visa","lines":[{"sku":"MUG","quantity":1}]}'

GRACE=$(curl -s http://localhost:5080/dev/token/grace)
curl -s http://localhost:5080/orders -H "Authorization: Bearer $ADA"
curl -s http://localhost:5080/orders -H "Authorization: Bearer $GRACE"

[{"id":"3179f9c4-07ba-4f64-ac64-e7026995cc89","customerId":"TraxJwt:ada","total":12.00,"placedAt":"2026-10-18T19:30:06.689317Z"}]
[{"id":"fb90a6f5-f5e0-4a89-b6cc-d76141452907","customerId":"TraxJwt:grace","total":12.00,"placedAt":"2026-10-18T19:30:06.837553Z"}]

Each sees their own. A member of staff sees both, and every order from the chapters before this one, but cannot place an order:

LIN=$(curl -s 'http://localhost:5080/dev/token/lin?staff=true')
curl -s http://localhost:5080/orders -H "Authorization: Bearer $LIN"
curl -i -X POST http://localhost:5080/orders -H "Authorization: Bearer $LIN" \
  -H 'Content-Type: application/json' \
  -d '{"paymentToken":"tok_visa","lines":[{"sku":"MUG","quantity":1}]}'

HTTP/1.1 403 Forbidden

The orders from earlier chapters belong to ada and grace without a scheme in front of them, so no customer who signs in now sees them. They are staff's to read.

SDK Reference

AddTraxJwtAuth | TraxAuthorize | TraxPrincipal | ITrainExecutionService | Scope a data context to the caller | Effect data testing

Next: 6.8 What it refuses