API Call through Entra Application Proxy to Secured On-Premise API

Question

Is there a method to make an API call through the Entra Application Proxy to an on-premise API secured with Microsoft.Identity.Web Framework, while ensuring that the JWT token is passed from the proxy to the API?

The goal is to call a secured API from an Android app located outside the network. The API is on-premise and secured using the Microsoft.Identity.Web Framework, with endpoints configured to validate a JWT token from Entra ID. When generating a token (e.g., using Postman), the API call to the secured API on the internal network is successful.

However, after publishing the API using Entra Application Proxy, calling the secured API with a token results in a "401 Unauthorized" error. Unsecured endpoint calls work as expected. While changing pre-auth to passthrough resolves the issue, it effectively replicates a direct API call.

Upon inspecting the headers, it's evident that the authorization header is dropped by the Entra App Proxy, leading to the 401 error. Attempts to establish Header SSO did not yield the configured headers on either secured or unsecured endpoints. Although a custom header with the Entra ID token can be added to make the API call, this approach poses security risks. Securing the connection between the connector and the API is a possible interim solution.

Other than Header-based SSO, what are the recommended methods for making an API call through Entra Application Proxy to a secured on-premise API, with a focus on securely passing the JWT token from the proxy to the API? Should I implement a different method of authentication/authorization in the api?