title: How to start with OAuth Client Credentials to protect WebApi using OWIN Oauth?
body: <p>I am a newbie to OAuth 2.0.</p>
  <p>I have fairly read the <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-23#page-22" rel="nofollow noreferrer">OAuth 2.0 doc</a> and I saw there are four types of methods for obtaining Authorization.</p>
  <blockquote>
  <p>Types of obtaining authorization:</p>
  </blockquote>
  <pre><code>1.Implicit Grant
  2.Resource Owner Password Credentials Grant
  3.Client Credentials Grant
  4.Authorization Code Grant
  </code></pre>
  <p>In my case, I have Client application, Resource owner, Resource server and Authorization server.</p>
  <p><strong>Resource server</strong> is a website where <strong>Resource owner</strong> registers with his/her credentials.</p>
  <p><strong>Client application</strong> is a third party website who registers into resource server and gets the Client application credentials for accessing it in future.</p>
  <p><strong>Authorization server</strong> checks the client credentials from client app and grants access token to the client app.</p>
  <p>Let us consider, <em><strong>resource server as &quot;www.serversite.com&quot;, authorization server as &quot;www.authserver.com&quot; and client application as &quot;www.clientapp.com&quot;</strong></em>.</p>
  <blockquote>
  <p>Flow:</p>
  </blockquote>
  <p><strong>Step 1:</strong> Also make an assumption that <a href="http://www.serversite.com" rel="nofollow noreferrer">www.serversite.com</a> as a payment gateway site and the client has to integrate &quot;www.serversite.com&quot; into &quot;www.clientapp.com&quot; for creating, executing and refunding payments.</p>
  <p><strong>Step 2:</strong> So the client &quot;www.clientapp.com&quot; creates an app in server &quot;www.serversite.com&quot; and gets API credentials.</p>
  <p><strong>Step 3:</strong> Using these API credentials, the client &quot;www.clientapp.com&quot; makes an access token request to the auth server &quot;www.authserver.com&quot;.</p>
  <p><strong>Step 4:</strong> If the API credentials from client app are valid then the auth server grants an access token.</p>
  <p><strong>step 5:</strong> With this access token, client app request the resource server for further operations like creating payments as well as executing payments.</p>
  <blockquote>
  <p><strong>My questions:</strong></p>
  </blockquote>
  <p>I am using <a href="http://www.asp.net/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server" rel="nofollow noreferrer">ASP.NET Web API for authorization server</a> and using <a href="http://msdn.microsoft.com/en-us/library/microsoft.owin.security.oauth%28v=vs.113%29.aspx" rel="nofollow noreferrer">OWIN.OAuth</a> for generating access token, refresh token, authorization and all the stuffs needed to authorize the client app.</p>
  <p>But, in this link (<a href="http://www.asp.net/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server" rel="nofollow noreferrer">OWIN OAuth 2.0 Authorization Server</a>), I found that, the web api authorize the client app using <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-23#section-4.3" rel="nofollow noreferrer">&quot;Resource Owner Password Credentials Grant&quot;</a> and the sample provided for implementing Owin.OAuth in web api is great, but I have lot of confusions roaming in my mind.</p>
  <ul>
  <li><p>Which way of obtaining authorization is suitable for my process?
  (<strong>Client Credentials flow or Resource Owner Password Credentials flow</strong>)</p>
  </li>
  <li><p><strong>How to implement Client Credentials Grant type using ASP.NET Web
  API(OWIN OAuth)?</strong></p>
  </li>
  <li><p>Also provide some samples or links that may be helpful for me?</p>
  </li>
  </ul>
  <p>Thanks in advance.</p>