6.8 What it refuses

Comment out builder.Services.AddTraxApi(); and start the application:

fail: Microsoft.Extensions.Hosting.Internal.Host[11]
      Hosting failed to start
      System.InvalidOperationException: One or more registered trains declare [TraxAuthorize] but no ITrainAuthorizationService is registered in the DI container. Call services.AddTraxApi() (or register a custom ITrainAuthorizationService) before building the host. If this process intentionally runs no API submissions (for example a scheduler-only worker), opt out via AddMediator(m => m.AllowMissingAuthorizationService()). Authorized trains: IPlaceOrderTrain.

PlaceOrder declares who may run it, and nothing is registered to check it, so the host refuses to serve rather than run every train for everyone.

Put the line back. Now start the application outside Development:

ASPNETCORE_ENVIRONMENT=Production Auth__Authority=https://id.example Auth__Audience=shopfront \
  dotnet run --urls http://localhost:5080

It starts, and /dev/token/ada answers 404: Production reads its keys from the identity provider, never sees the development key, and has no route that mints tokens. Had the development key been registered there, the host would have refused it by its marker.

SDK Reference

AddTraxJwtAuth | TraxAuthorize | TraxPrincipal | ITrainExecutionService | Scope a data context to the caller | Effect data testing

Next: 6.9 Test it