title: OIDC, Blazor, and the API. How can I tell my API who I am?
body: <p>I'm misunderstanding something quite fundamental here, because though I can get this setup to work, I can't get it to work the way I want ....</p>
  <p>In summary I have: IdentityServer4 + Blazor + WebAPI. The ID server knows about the Blazor app and it knows about the API.
  The Blazor app is secured and correctly redirects to the id server. Once authenticated the Blazor app goes off to get a token from the id server and uses that to call the API.</p>
  <p>Identity is setup thus:</p>
  <pre><code>                new Client
                  {
                      ClientId = &quot;blazor&quot;,
                      ClientName = &quot;Blazor&quot;,
  
                      AllowedGrantTypes = GrantTypes.Code,
                      Enabled = true,
                      
                      RequireClientSecret = false,
                      RequirePkce = true, 
  
                      AllowedCorsOrigins = new String[] { blazorapp },
  
                      RedirectUris = { blazorapp },
                      PostLogoutRedirectUris = { blazorapp },
  
                      AllowedScopes =
                      {
                          IdentityServerConstants.StandardScopes.OpenId,
                          IdentityServerConstants.StandardScopes.Profile,
                          &quot;blazor&quot;
                      },
  
                      AlwaysIncludeUserClaimsInIdToken = true
                  },
                  new Client
                  {
                      ClientId = &quot;documents&quot;,
                      ClientName = &quot;Documents&quot;,
  
                      AllowedGrantTypes = GrantTypes.ClientCredentials,
  
                      AllowedCorsOrigins = new String[] { api },
  
                      ClientSecrets =
                      {
                          new Secret(&quot;secret&quot;.Sha256())
                      },
  
                      AllowedScopes = { &quot;documents&quot; }
                  }
  </code></pre>
  <p>I want to stress that everything works, I can logon via the id server and Blazor renders the results of any API calls.
  The problem is; I want the API to know who the user is. The claims at the API end only contain details about the server to server token exchange (i.e. this client id etc.). How can I call the API from within Blazor (assume I still need to use tokens??) and have the HTTPContext (and claims within) on the API side aware of who the user is?</p>