Jellyfin 12.0 removed the named "DefaultAuthorization" policy; it's now options.DefaultPolicy (CustomAuthentication scheme + DefaultAuthorizationRequirement). [Authorize(Policy = "DefaultAuthorization")] therefore threw InvalidOperationException: "policy not found" on every /AnilistSync/* call. Bare [Authorize] uses the default policy, which is the intended form. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>