ah! Finally managed to get authentication to work properly (although, the API's authorization filter is returning 500 instead of 401 but it doesn't really matter) - so when you're authenticated on the website, your ClaimsIdentity gets encrypted into a JWT that's sent in the Authentication header to Rubberduck.WebApi, where the JWT is deemed to securely encapsulate all the claims.
but, testing the API with a JWT is kind of a PITA, so you can alternatively supply a GitHub PAT into your Authentication header, and the API's authentication filter will query GitHub and fetch your claims and package a JWT that then goes through the rest of the auth pipeline
@Freeflow it's an org-level private repo, for now members of @rubberduck-vba/contributors and @rubberduck-vba/dev have access. not sure it's a good idea to make it public just yet, but ...you're not in the org???