diff --git a/contrib/bruno/Get Posts.bru b/contrib/bruno/Get Posts.bru
new file mode 100644
index 00000000..bafe95b1
--- /dev/null
+++ b/contrib/bruno/Get Posts.bru	
@@ -0,0 +1,16 @@
+info:
+  name: Get Posts
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: https://jsonplaceholder.typicode.com/users
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs: This request retrieves a list of users from the JSONPlaceholder API.
diff --git a/contrib/bruno/Untitled.bru b/contrib/bruno/Untitled.bru
new file mode 100644
index 00000000..168811b2
--- /dev/null
+++ b/contrib/bruno/Untitled.bru
@@ -0,0 +1,15 @@
+info:
+  name: Untitled
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: ""
+  auth: inherit
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
diff --git a/contrib/bruno/blogs.yml b/contrib/bruno/blogs.yml
new file mode 100644
index 00000000..2767b01d
--- /dev/null
+++ b/contrib/bruno/blogs.yml
@@ -0,0 +1,15 @@
+info:
+  name: blogs
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: "{{Blogs}}/api/v1/blog"
+  auth: inherit
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
diff --git a/contrib/bruno/environments/Development.yml b/contrib/bruno/environments/Development.yml
new file mode 100644
index 00000000..0fd5430e
--- /dev/null
+++ b/contrib/bruno/environments/Development.yml
@@ -0,0 +1,6 @@
+name: Development
+variables:
+  - name: Blogs
+    value: https://localhost:5003
+  - name: Authority
+    value: https://localhost:5001
diff --git a/contrib/bruno/environments/Production.yml b/contrib/bruno/environments/Production.yml
new file mode 100644
index 00000000..fda7173b
--- /dev/null
+++ b/contrib/bruno/environments/Production.yml
@@ -0,0 +1,6 @@
+name: Production
+variables:
+  - name: Authority
+    value: https://yavsc.pschneider.fr
+  - name: Blogs
+    value: https://blogs.pschneider.fr
diff --git a/contrib/bruno/opencollection.yml b/contrib/bruno/opencollection.yml
new file mode 100644
index 00000000..146a7b58
--- /dev/null
+++ b/contrib/bruno/opencollection.yml
@@ -0,0 +1,42 @@
+opencollection: 1.0.0
+
+info:
+  name: blogs
+config:
+  proxy:
+    inherit: true
+    config:
+      protocol: http
+      hostname: ""
+      port: ""
+      auth:
+        username: ""
+        password: ""
+      bypassProxy: ""
+
+request:
+  auth:
+    type: oauth2
+    flow: authorization_code
+    authorizationUrl: "{{Authority}}/connect/authorize"
+    accessTokenUrl: "{{Authority}}/connect/token"
+    callbackUrl: https://localhost:5001
+    credentials:
+      clientId: postit
+      placement: body
+    scope: openid blogs
+    pkce: {}
+    tokenConfig:
+      id: credentials
+      placement:
+        header: Bearer
+      source: access_token
+    settings:
+      autoFetchToken: true
+      autoRefreshToken: false
+bundled: false
+extensions:
+  bruno:
+    ignore:
+      - node_modules
+      - .git
diff --git a/src/Yavsc.Blogs/appsettings-blogs.json b/src/Yavsc.Blogs/appsettings-blogs.json
index cac9f06b..a33b8102 100644
--- a/src/Yavsc.Blogs/appsettings-blogs.json
+++ b/src/Yavsc.Blogs/appsettings-blogs.json
@@ -8,12 +8,26 @@
       "https://localhost:5005"
     ]
   },
+  "ConnectionStrings": {
+    "YavscConnection": "Server=localhost;Port=5432;Database=lame-db-name;Username=lame-user-name;Password=lame-password;"
+  },
   "Logging": {
     "LogLevel": {
       "Default": "Information",
       "Microsoft": "Warning",
-      "Microsoft.Hosting.Lifetime": "Information"
+      "Microsoft.Hosting.Lifetime": "Information",
+      "Microsoft.AspNetCore.Authentication": "Debug"
     }
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "Kestrel": {
+    "Endpoints": {
+      "Http": {
+        "Url": "http://localhost:5002"
+      },
+      "Https": {
+        "Url": "https://localhost:5003"
+      }
+    }
+  }
 }
diff --git a/src/Yavsc.Server/Helpers/ServiceExtensions.cs b/src/Yavsc.Server/Helpers/ServiceExtensions.cs
index 57e9f770..3abc723b 100644
--- a/src/Yavsc.Server/Helpers/ServiceExtensions.cs
+++ b/src/Yavsc.Server/Helpers/ServiceExtensions.cs
@@ -91,7 +91,31 @@ public static class ServiceExtensions
                 RoleClaimType = YavscConstants.RoleClaimType
             };
             options.MapInboundClaims = true;
+
+            // Dev: every Yavsc resource service (Yavsc.Api, Yavsc.Blogs,
+            // Yavsc.Org itself) validates JWTs against the OP that runs
+            // on https://localhost:5001 with a self-signed dev cert.
+            // The default .NET HttpClient rejects self-signed certs, so
+            // JwtBearer's backchannel silently fails to fetch the OIDC
+            // discovery + JWKS. With an empty ValidIssuer, every token
+            // is rejected with IDX10204 ("ValidIssuer is null or
+            // whitespace"). Telling the backchannel to skip TLS
+            // validation unblocks discovery in dev. Production uses a
+            // real CA-signed cert and the default validation path; the
+            // override is gated on HostingEnvironment == Development
+            // and only fires when the consumer opt-in via the
+            // 'Yavsc:Dev:TlsInsecure' configuration flag (default
+            // false), so a misconfigured production environment cannot
+            // silently downgrade TLS.
+            if (configuration.GetValue<string>("ASPNETCORE_ENVIRONMENT") == "Development")
+            {
+                options.BackchannelHttpHandler = new HttpClientHandler
+                {
+                    ServerCertificateCustomValidationCallback =
+                        (_, _, _, _) => true
+                };
+            }
             configure?.Invoke(options);
         });
     }
-}
\ No newline at end of file
+}