Configure OpenApi in .NET 10

Swagger and Scalar both hit a nasty bug after migrating to .NET 10. The max json depth of 64 is reached for some reason and the UI refuses to render correctly.

ebeeraheem

View Profile
4 views
Aug 20, 2026

Create a bearer scheme transformer as such

internal sealed class BearerSecuritySchemeTransformer(
    IAuthenticationSchemeProvider authenticationSchemeProvider
) : IOpenApiDocumentTransformer
{
    public async Task TransformAsync(
        OpenApiDocument document,
        OpenApiDocumentTransformerContext context,
        CancellationToken cancellationToken
    )
    {
        document.Info.Title = "Your API";
        document.Info.Description = "Your API description.";

        var authenticationSchemes = await authenticationSchemeProvider.GetAllSchemesAsync();

        // Only proceed if Bearer authentication is configured
        if (authenticationSchemes.Any(authScheme => authScheme.Name == "Bearer"))
        {
            // Define the Bearer security scheme
            var bearerScheme = new OpenApiSecurityScheme
            {
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                BearerFormat = "JWT",
                In = ParameterLocation.Header,
                Description = "JWT Authorization header using the Bearer scheme."
            };

            // Ensure components are initialized
            document.Components ??= new OpenApiComponents();

            // Add the scheme to the document components
            document.AddComponent("Bearer", bearerScheme);

            // Create a security requirement referencing the scheme
            var securityRequirement = new OpenApiSecurityRequirement
            {
                [new OpenApiSecuritySchemeReference("Bearer", document)] = []
            };

            // Apply the requirement to all operations
            foreach (var operation in document.Paths.Values.SelectMany(p =>
                         p.Operations?.Select(op => op.Value) ?? []))
            {
                operation.Security ??= new List<OpenApiSecurityRequirement>();
                operation.Security.Add(securityRequirement);
            }
        }
    }
}

Then proceed to configure swagger as you normally would

builder.Services.AddSwaggerGen(options =>
{
    options.SwaggerDoc("v1", new OpenApiInfo
    {
        Title = "Your API",
        Version = "v1",
        Description = "Your API description."
    });

    options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        Type = SecuritySchemeType.Http,
        In = ParameterLocation.Header,
        Name = "Authorization",
        Scheme = "bearer",
        BearerFormat = "JWT",
        Description = "Enter your token here:"
    });

    // Display XML comments in SwaggerUI
    options.IncludeXmlComments(Path.Combine(AppContext.BaseDirectory, "AppName.Api.xml"));
    options.IncludeXmlComments(Path.Combine(AppContext.BaseDirectory, "AppName.Application.xml"));
});

Register the OpenApi transformer

builder.Services.AddOpenApi(options => 
	options.AddDocumentTransformer<BearerSecuritySchemeTransformer>());

Build the app and then map openapi and the swagger UI

app.MapOpenApi();
app.UseSwagger();
       app.UseSwaggerUI(options =>
       {
           options.SwaggerEndpoint("/openapi/v1.json", "Your API v1");
       });

This should fix the json depth error.