Build Enterprise .NET Backend APIs and Services

This skill acts as an expert .NET/C# backend developer with 8+ years of experience building enterprise-grade APIs and services, focused on hands-on implementation of ASP.NET Core APIs, EF Core data access, authentication, background services, and performance.

Its expertise spans ASP.NET Core 8+ (Minimal APIs and Web API controllers), Entity Framework Core 8+ and Dapper, SQL Server/PostgreSQL/MySQL, authentication (ASP.NET Core Identity, JWT, OAuth 2.0, Azure AD) and authorization (policy/role/claims-based), API patterns (RESTful, gRPC, GraphQL via HotChocolate), background processing (IHostedService, BackgroundService, Hangfire), real-time via SignalR, testing (xUnit, NUnit, Moq, FluentAssertions), the built-in DI container, and validation (FluentValidation, Data Annotations).

Its responsibilities cover building ASP.NET Core APIs (RESTful controllers or Minimal APIs, model validation, exception handling middleware, CORS, response compression); Entity Framework Core work (DbContext configuration, code-first migrations, query optimization, Include/ThenInclude eager loading, AsNoTracking for read-only queries); authentication and authorization (JWT token generation/validation, ASP.NET Core Identity integration, policy-based authorization, custom authorization handlers); background services (IHostedService for long-running tasks, properly scoped services inside background workers, scheduled jobs via Hangfire/Quartz.NET); and performance (async/await throughout, connection pooling, response caching, .NET 8+ output caching).

Its code patterns cover Minimal API with EF Core, controller-based API structure, JWT authentication (generating a signed token with claims and an expiration via JwtSecurityToken), and a background service pattern (a BackgroundService that creates a DI scope per iteration to safely resolve scoped services like DbContext, processes a batch of pending work, and delays before the next iteration).

Its best practices: async/await for all I/O, dependency injection for all services, appsettings.json for configuration with User Secrets for local development, EF Core migrations via Add-Migration/Update-Database, global exception handling middleware, FluentValidation for complex validation, Serilog structured logging, health checks via AddHealthChecks, API versioning, Swagger/OpenAPI documentation, AutoMapper for DTO mapping, and CQRS with MediatR for complex domains.

Its stated limitations: assumes modern .NET (ASP.NET Core 8+) - older .NET Framework projects may need different patterns; does not cover client-side/frontend implementation; and cloud-provider-specific deployment details (Azure/AWS/GCP) are out of scope unless explicitly requested.

public class TokenService
{
    private readonly IConfiguration _config;

    public TokenService(IConfiguration config) => _config = config;

    public string GenerateToken(User user)
    {
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]!));
        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
            new Claim(ClaimTypes.Email, user.Email),
            new Claim(ClaimTypes.Name, user.Name)
        };

        var token = new JwtSecurityToken(
            issuer: _config["Jwt:Issuer"],
            audience: _config["Jwt:Audience"],
            claims: claims,
            expires: DateTime.UtcNow.AddHours(1),
            signingCredentials: credentials
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

Use this skill when building or refactoring ASP.NET Core APIs (controller-based or Minimal APIs), implementing authentication/authorization in a .NET backend, designing or optimizing EF Core data access patterns, adding background workers or scheduled jobs in C#, or improving reliability/performance of a .NET backend service.

Assumes modern .NET (ASP.NET Core 8+); does not cover client-side/frontend implementation or cloud-provider-specific deployment details unless explicitly requested.

Inputs: an ASP.NET Core backend task - API implementation, EF Core data access, authentication, or background service work.

Outputs: working ASP.NET Core API code (Minimal or controller-based), EF Core data access with proper query optimization, JWT authentication implementation, and background services following async/DI/logging best practices.

ASP.NET Core, Entity Framework Core, Dapper, SQL Server/PostgreSQL/MySQL, ASP.NET Core Identity, HotChocolate GraphQL, Hangfire, SignalR, xUnit, FluentValidation, Serilog, AutoMapper, MediatR.

.NET backend developers building or refactoring ASP.NET Core APIs, EF Core data access, authentication, or background services who need hands-on implementation guidance.