title: ASP.NET Web API - Authenticated Encrypted JWT Token - Do I need OAuth?
body: <p>I'm considering using authenticated encrypted JWT tokens to authenticate / authorized access to an ASP.NET Web API application.</p>
  
  <p>Based on what I've read so far, it seems to me like it is an option to generate JWT tokens from a token service and pass them to Web API via the http authorization header.</p>
  
  <p>I have found some good code examples on implementing the JWT creation and consumption (Pro ASP.NET Web API Security by Badrinarayanan Lakshmiraghavan). </p>
  
  <p>I'm trying to understand if I need a full OAuth implementation to support this, or if I can simply pass the tokens along in the auth header.</p>
  
  <p>Assuming the tokens are properly encrypted and signed, is there any inherent security flaw in keeping things simple without having to use OAuth?</p>
  
  <p>Trying to keep things as simple as possible for my needs without compromising security.</p>