如何在第三方ASP.NET Web API客户端中使用Oauth生成的令牌？

Question

I am new to asp.net web API.

I am planning to use Token based authentication for a simple web API I am creating in C#.

I have created the API and used the following code to create the token

OAuthOptions = new OAuthAuthorizationServerOptions
{
   TokenEndpointPath = new PathString("/Token"),
   Provider = new SimpleAuthorizationServerProvider(),
   AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
   AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
   // In production mode set AllowInsecureHttp = false
   AllowInsecureHttp = true
};

I used postman tool to test the api by copying the token generated by the above code and by prefixing the keyword Bearer to it.

Everything works fine.

However, I have the following questions, for which I couldn't find a proper answer.

1. How a third party client will know about the generated token?
2. Since the token expires in 14 days, how the client will know about the updated token?

Answer 1

You pass them back the token from the login and they use it as the bearer token.

You can also give them a refresh token that acts like a username/password, client checks of they get an auth failure and then they'll use the refresh token to get a new bearer token.

Really depends on your app. If it's a mobile app, you might just set it to never expire to make things easier (if there is no risk). Websites you can ask them to log in again after 14 days, or use a refresh token. Lots of options