After upgrading to 9.3 portal says "Potentially dangerous behavior was detected"

Did you specify the trusted source key during installation of the API Server? It seems you did not.

3. Run the following command:

imxclient edit-config /path <web.config file path> -T

(for example imxclient edit-config /path c:\inetpub\wwroot\apiserver\web.config -T)

According to the example, I don't have to.

Where can I find the trusted source key? Do I generate it? If so, how?

I admit I wasn't clear enough in my comment.

You normally specify the trusted source key during the wizard driven (GUI based) installation of the API Server.

That's what my question was. Did you specify the key during the installation?

Yes.

I tried this:
imxclient edit-config /path <web.config file path> /trustedsourcekey <Key>

with the key I entered in the installation but the same error occurred.

Do you know why Designer -> Web Server configurations -> ApiServer -> Program is empty?

It is empty by intention in 9.3 as the API Server can host more than one type of program (Web portal, Password Reset Portal, ...) that might require different authenticator settings.

So the imxclient option seems to be buggy.

Mmh... In that case - the API Server shouldn't come up with the error message.

Can you post (obfuscated of course) web.config and appsettings.json from the API Server?

web.config:

<?xml version="1.0"?>
<configuration>

  <connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
    <EncryptedData>
      <CipherData>
        <CipherValue>LoremipsumdolorsitametconsecteturadipiscingelitNullamviverramassaegetmolestielaciniafelistellussagittisjustoatlobortismagnadolordapibusnibhInaliquammassaidvolutpatvariusturpissapienvolutpatdolorquistristiqueauguedolorvelnuncFusceutlobortismetusVestibulumvulputatepurussitametnequemalesuadarhoncusNullambibendumveliteuquamscelerisqueblanditPellentesqueduifelisaliquetvitaedictumdapibusrhoncuseuerosIntegeratsapienconsequatdapibusmagnaegetsollicitudinlacusUtcursusaugueeuelitvehiculaegetegestasloremconsequatVivamusmetusloremtinciduntidblanditquissuscipitnonneque==</CipherValue>
      </CipherData>
    </EncryptedData>
  </connectionStrings>
  <system.web>

    <!-- MaxRequestLength in KB -->
    <httpRuntime enableVersionHeader="false" maxRequestLength="10240" executionTimeout="3600" />

  </system.web>

	<system.webServer>
  <handlers>
   <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2"
    resourceType="Unspecified" />
  </handlers>
  <aspNetCore processPath="dotnet" arguments=".\bin\QBM.CompositionApi.Server.AspNet.dll"
   startupTimeLimit="1200" stdoutLogEnabled="true" stdoutLogFile=".\App_Data\Logs"
   hostingModel="inprocess">
  </aspNetCore>
  <urlCompression doStaticCompression="true" doDynamicCompression="true" />
  <security>
   <requestFiltering>
    <requestLimits maxQueryString="32768" />
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

appsettings.json:

{
  "Settings": {
    "DeploymentTarget": "Server\\Web\\BusinessApiServer",
    "BaseURL": "https://acme.com/ApiServer/"
  },
  "ConnectionStrings": {},
  "RuntimeDirs": {
    "Cache": "C:\\inetpub\\wwwroot\\ApiServer\\App_Data\\Cache\\Cache",
    "AssemblyCache": "C:\\inetpub\\wwwroot\\ApiServer\\App_Data\\Cache\\AssemblyCache"
  },
  "ConnectionBehaviour": {
    "TokenCertificateThumbprint": "LOREMIPSUM",
    "CheckSessionCertificate": "True"
  }
}

Looks okay to me. Can you try to restart the server?

in addition.

What runtimes are installed?

Use the following command in a shell on the server hosting the weeb applications.

dotnet --list-runtimes