title: Issuing JWT token myself versus using IdentityServer4(OIDC) for Web API
body: <p><a href="https://identityserver4.readthedocs.io/en/release/intro/support.html" rel="noreferrer">https://identityserver4.readthedocs.io/en/release/intro/support.html</a></p>
  
  <p>I currently issue tokens myself in my web api with <code>JwtSecurityToken</code> and I use standard ASP.NET Core middleware calling <code>AddJwtBearer</code> to verify the tokens. It works fine.</p>
  
  <p>What advantage will give me using OpenID Connect (through IdentityServer4) over the approach described above? How to answer myself question "Do I need OpenID Connect?"</p>
  
  <p>From my basic understanding about OpenID Connect, it is used to allow third parties to access your API. But I make API for myself and not for third parties and I don't know why should I favor IdentityServer/OpenIddict over my simple approach.</p>
  
  <p>I read that if I want Single sign-on I should use this, but JWTs itself aren't bound to any specific domain and I can use single sign-on with just pure JWTs(they're self-contained)</p>
  
  <p>I understand it implements some kind of standard for issuing tokens. (protocol). It might be good if I ever wish to expose some API to third parties. But for internal APIs? Is it worth using it?</p>
  
  <p>This is my current auth flow (from <a href="https://jonhilton.net/2017/10/11/secure-your-asp.net-core-2.0-api-part-1---issuing-a-jwt/" rel="noreferrer">https://jonhilton.net/2017/10/11/secure-your-asp.net-core-2.0-api-part-1---issuing-a-jwt/</a>)
  <a href="https://i.stack.imgur.com/f2ZhM.png" rel="noreferrer"><img src="https://i.stack.imgur.com/f2ZhM.png" alt="enter image description here"></a></p>
  
  <p>What I really want to implement to secure my Web API:</p>
  
  <ul>
  <li>Login</li>
  <li>Logout (invalidate token?)</li>
  <li>No consent screen (want to have API only for myself), auth happens in the background in my native desktop, mobile, web app (no redirection)</li>
  <li>Remember me feature (refresh tokens?)</li>
  </ul>
  
  <p>Could someone clear out the fuzzy picture of OIDC/OAuth2 for me? i.e. give me some disadvantages going my own way (implementing my own flow) and advantages of using OIDC in place of my own flow. </p>
  
  <p>What will it save me from doing later on (on the client-side for example), and what will not. And most particularly, is it good to start every project using standard flows like OIDC? Will it somehow benefit me in the future?</p>