title: How are bearer tokens stored server-side in Web API 2?
body: <p>I am setting up bearer token authentication in Web API 2, and I don't understand how (or where) the bearer token is being stored server-side. Here is the relevant code:</p>
  
  <p><strong>Startup:</strong></p>
  
  <pre><code>public partial class Startup
  {
      public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
      public static Func&lt;UserManager&lt;IdentityUser&gt;&gt; UserManagerFactory { get; set; }
      public static string PublicClientId { get; private set; }
  
      static Startup()
      {
          PublicClientId = "self";
          UserManagerFactory = () =&gt; new UserManager&lt;IdentityUser&gt;(new UserStore&lt;IdentityUser&gt;());
          OAuthOptions = new OAuthAuthorizationServerOptions
          {
              TokenEndpointPath = new PathString("/Token"),
              Provider = new ApplicationOAuthProvider(PublicClientId, UserManagerFactory),
              AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              AllowInsecureHttp = true
          };
      }
  
      public void ConfigureAuth(IAppBuilder app)
      {
          // Enable the application to use a cookie to store information for the signed in user
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
          // Use a cookie to temporarily store information about a user logging in with a third party login provider
          app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
  
          app.UseOAuthBearerTokens(OAuthOptions);
      }
  }
  </code></pre>
  
  <p><strong>WebApiConfig:</strong></p>
  
  <pre><code>public class WebApiConfig
  {
      public static void ConfigureWebApi()
      {
          Register(GlobalConfiguration.Configuration);
      }
  
      public static void Register(HttpConfiguration http)
      {
          AuthUtil.ConfigureWebApiToUseOnlyBearerTokenAuthentication(http);
          http.Routes.MapHttpRoute("ActionApi", "api/{controller}/{action}", new {action = Actions.Default});
      }
  }
  </code></pre>
  
  <p><strong>AuthUtil:</strong></p>
  
  <pre><code>public class AuthUtil
  {
      public static string Token(string email)
      {
          var identity = new ClaimsIdentity(Startup.OAuthOptions.AuthenticationType);
          identity.AddClaim(new Claim(ClaimTypes.Name, email));
          var ticket = new AuthenticationTicket(identity, new AuthenticationProperties());
          var currentUtc = new SystemClock().UtcNow;
          ticket.Properties.IssuedUtc = currentUtc;
          ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromMinutes(30));
          var token = Startup.OAuthOptions.AccessTokenFormat.Protect(ticket);
          return token;
      }
  
      public static void ConfigureWebApiToUseOnlyBearerTokenAuthentication(HttpConfiguration http)
      {
          http.SuppressDefaultHostAuthentication();
          http.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
      }
  }
  </code></pre>
  
  <p><strong>LoginController:</strong></p>
  
  <pre><code>public class LoginController : ApiController
  {
      ...
  
      public HttpResponseMessage Post([FromBody] LoginJson loginJson)
      {
          HttpResponseMessage loginResponse;
          if (/* is valid login */)
          {
              var accessToken = AuthUtil.Token(loginJson.email);
              loginResponse = /* HTTP response including accessToken */;
          }
          else
          {
              loginResponse = /* HTTP response with error */;
          }
          return loginResponse;
      }
  }
  </code></pre>
  
  <p>Using the above code, I'm able to login and store the bearer token client-side in a cookie, and then make calls to controllers marked with [Authorize] and it lets me in.</p>
  
  <p><strong>My questions are:</strong></p>
  
  <ol>
  <li><p>Where / how is the bearer token being stored server-side? It seems like this is hapenning through one of the OWIN calls but I can't tell where.</p></li>
  <li><p>Is it possible to persist the bearer tokens to a database server-side so that they can remain in place after a Web API server restart?</p></li>
  <li><p>If the answer to #2 is no, is there anyway for a client to maintain its bearer token and re-use it even after the Web API goes down and comes back up? While this may be rare in Production, it can happen quite often doing local testing.</p></li>
  </ol>