This code checks key from url and secret from auth header password for basic auth againts the Client.ClientId as key and ClientSecret.Value as secret-hash.

BasicAuthUsingConfigurationDbContext.cs

try
{
    var authHeader = Request.Headers.Authorization.ToString();
    if (!authHeader.StartsWith("Basic "))
        return Unauthorized();

    var apiSecretHash = Encoding.ASCII.GetString(Convert.FromBase64String(authHeader[6..]))
        .Split(':')[1]
        .ToSha256();

    var secretValid = await _configDb.Clients
        .Include(c => c.ClientSecrets)
        .Where(c => c.ClientId == apiKey)
        .Select(c => c.ClientSecrets.Any(cs => cs.Value == apiSecretHash))
        .FirstOrDefaultAsync();
    if (!secretValid)
        return Unauthorized();
}
catch
{
    return Unauthorized();
}