The last time I looked at Core, I couldn't even add authentication to endpoints on a pure Web API project, that was a couple of beta's back though, hopefully it's gotten better.