Configure OpenApi in .NET 10

Swagger and Scalar both hit a nasty bug after migrating to .NET 10. The max json depth of 64 is reached for some reason and the UI refuses to render correctly.

ebeeraheem

View Profile
217 views
Aug 20, 2026

Create a bearer scheme transformer as such

internal sealed class BearerSecuritySchemeTransformer(
    IAuthenticationSchemeProvider authenticationSchemeProvider
) : IOpenApiDocumentTransformer
{
    public async Task TransformAsync(
        OpenApiDocument document,
        OpenApiDocumentTransformerContext context,
        CancellationToken cancellationToken
    )
    {
        document.Info.Title = "Your API";
        document.Info.Description = "Your API description.";

        var authenticationSchemes = await authenticationSchemeProvider.GetAllSchemesAsync();

        // Only proceed if Bearer authentication is configured
        if (authenticationSchemes.Any(authScheme => authScheme.Name == "Bearer"))
        {
            // Define the Bearer security scheme
            var bearerScheme = new OpenApiSecurityScheme
            {
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                BearerFormat = "JWT",
                In = ParameterLocation.Header,
                Description = "JWT Authorization header using the Bearer scheme."
            };

            // Ensure components are initialized
            document.Components ??= new OpenApiComponents();

            // Add the scheme to the document components
            document.AddComponent("Bearer", bearerScheme);

            // Create a security requirement referencing the scheme
            var securityRequirement = new OpenApiSecurityRequirement
            {
                [new OpenApiSecuritySchemeReference("Bearer", document)] = []
            };

            // Apply the requirement to all operations
            foreach (var operation in document.Paths.Values.SelectMany(p =>
                         p.Operations?.Select(op => op.Value) ?? []))
            {
                operation.Security ??= new List<OpenApiSecurityRequirement>();
                operation.Security.Add(securityRequirement);
            }
        }
    }
}

Then proceed to configure swagger as you normally would

builder.Services.AddSwaggerGen(options =>
{
    options.SwaggerDoc("v1", new OpenApiInfo
    {
        Title = "Your API",
        Version = "v1",
        Description = "Your API description."
    });

    options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        Type = SecuritySchemeType.Http,
        In = ParameterLocation.Header,
        Name = "Authorization",
        Scheme = "bearer",
        BearerFormat = "JWT",
        Description = "Enter your token here:"
    });

    // Display XML comments in SwaggerUI
    options.IncludeXmlComments(Path.Combine(AppContext.BaseDirectory, "AppName.Api.xml"));
    options.IncludeXmlComments(Path.Combine(AppContext.BaseDirectory, "AppName.Application.xml"));
});

Register the OpenApi transformer

builder.Services.AddOpenApi(options => 
	options.AddDocumentTransformer<BearerSecuritySchemeTransformer>());

Build the app and then map openapi and the swagger UI

app.MapOpenApi();
app.UseSwagger();
       app.UseSwaggerUI(options =>
       {
           options.SwaggerEndpoint("/openapi/v1.json", "Your API v1");
       });

This should fix the json depth error.