title: Different Authentication Schemes for the Same ASP.NET Web API
body: <h2>The Situation</h2>
  
  <p>I have an upcoming project where the web pages will be making AJAX calls. External clients will also be provided a REST API. I will be implementing this project using ASP.NET MVC 4 with Web API.</p>
  
  <p>I have seen various examples online where people use the <code>[Authorize]</code> attribute for security. I presume this is whenever Web API is called via AJAX on a web page.</p>
  
  <p>I have also seen various examples where an API key was passed along with each request (via query string or header). I presume this is whenever Web API is called from an external system.</p>
  
  <h2>The Questions</h2>
  
  <p>Here are the questions that immediately come to mind:</p>
  
  <ul>
  <li>Should I be creating a separate controller for internal and external clients?</li>
  <li>or should I force the web pages to use the same external authentication model?</li>
  <li>or is there a way that external clients can use the Authorize attribute?</li>
  <li>or should I somehow support both forms or authentication at the same time?</li>
  </ul>
  
  <h2>A Side Note</h2>
  
  <p>A colleague pointed out that I might want to deploy the API to a totally different URL than where the web app is hosted. Along the same lines, he pointed out that the external API may need to be more coarse grain or evolve separately.</p>
  
  <p>I don't want to reinvent the wheel, here. This makes me wonder whether I should be using Web API as an internal API for my AJAX calls in the first place or if I should stick to old-school MVC actions with <code>[HttpPost]</code> attributes.</p>