config/packages/api_platform.yaml

api_platform:
    mapping:
        paths: ['%kernel.project_dir%/src/Entity']
    patch_formats:
        json: ['application/merge-patch+json']
    swagger:
        versions: [3]
        api_keys:
            apiKey:
                name: "Authorization"
                type: "header"

api/config/packages/security.yaml

security:
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    encoders:
        App\Entity\User:
            algorithm: bcrypt

    providers:
        db_provider:
            entity:
                class: App\Entity\User
                property: username

    firewalls:
        login:
            pattern:  ^/login
            stateless: true
            anonymous: true
            provider: db_provider
            json_login:
                check_path: /login
                username_path: username
                password_path: password
                require_previous_session: false
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure

        register:
            pattern:   ^/register
            anonymous: true

        docs:
            pattern:   ^/docs
            anonymous: true

        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        api:
            pattern:   ^/
            provider: db_provider
            stateless: true
            anonymous: false
            guard:
                authenticators:
                    - lexik_jwt_authentication.jwt_token_authenticator

    access_control:
        - { path: ^/login, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/docs, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/, roles: [ ROLE_USER ] }

config/routes/api_platform.yaml

api_platform:
    resource: .
    type: api_platform
    prefix: /api