If you've worked on ASP.NET Core APIs long enough, you've probably experienced this situation.

Everything works perfectly on your machine.

Users log in successfully. JWT tokens are generated. Protected endpoints return data exactly as expected.

Then you deploy to production.

Suddenly: