[Authorize] Always Returns 401 Even With Valid-Looking JWT Token

Authorization: Bearer eyJhbGciOiJIUzI1...

IDX14102: Unable to decode the header 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' as Base64Url encoded string.

 content-length: 0 
 date: Thu,20 Nov 2025 19:41:17 GMT 
 server: Kestrel 
 www-authenticate: Bearer error="invalid_token" 

[Authorize]
[HttpGet("UserInfo")]
public async Task<ActionResult<LoggedUserModel>> GetUserInfo()
{
    // Code never executes — authorization fails before entering the controller
}