Since Blazor has different rendering types, security arrangements will be different depending on which one you use. In the client rendering, you will be securing API access just like you would with any other web technologies or mobile applications, but with server rendering you will need to establish state-based storage. Going deeper, both options can use access tokens or access with refresh tokens; the main thing is how they get stored and accessed and how states can be updated to reflect this in the user experience.