title: ASP.Net Web API - Generate Bearer Token from ASP.NET MVC Project
body: <p>Sorry if this question is poorly worded, I am new to authentication.</p>
  
  <p>I have an ASP.NET MVC project that serves my web frontend and this is authenticated using OWIN and identity cookie based authentication. This seems to work fine independently of my Web API.</p>
  
  <p>I also have an ASP.NET Web API project that is also authenticated using OWIN and identity token based authentication e.g. make a request to the /Token endpoint and get a bearer token that can be used to make requests to the API endpoints. This works fine when called via postman using the bearer token generated via the /Token endpoint, but as I don't have the password when I want to call the API from the MVC application, I can't use the token endpoint to generate a token.</p>
  
  <p>My problem is I would like to be able to make requests to the ASP.NET Web API from my authenticated ASP.NET MVC application, how would I go about generating a token that I can call the Web API? Given that I have a ClaimsIdentity that has been authenticated. </p>
  
  <p>My Startup.Auth for my MVC project is:</p>
  
  <pre><code>public partial class Startup 
  {
      public void ConfigureAuth(IAppBuilder app)
      {
          // Configure the db context, user manager and signin manager to use a single instance per request
          app.CreatePerOwinContext(ApplicationDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
          app.CreatePerOwinContext&lt;ApplicationSignInManager&gt;(ApplicationSignInManager.Create);
          app.CreatePerOwinContext&lt;ApplicationRoleManager&gt;(ApplicationRoleManager.Create);
  
          // Enable the application to use a cookie to store information for the signed in user
          // and to use a cookie to temporarily store information about a user logging in with a third party login provider
          // Configure the sign in cookie
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              LoginPath = new PathString("/Account/Login"),
              Provider = new CookieAuthenticationProvider
              {
                  // Enables the application to validate the security stamp when the user logs in.
                  // This is a security feature which is used when you change a password or add an external login to your account.  
                  OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
                      validateInterval: TimeSpan.FromMinutes(30),
                      regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
              }
          });            
      }
  }
  </code></pre>
  
  <p>My Startup.Auth for my Web API project is:</p>
  
  <pre><code>public partial class Startup
  {
      public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
  
      public static string PublicClientId { get; private set; }
  
      // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864
      public void ConfigureAuth(IAppBuilder app)
      {
          // Configure the db context and user manager to use a single instance per request
          app.CreatePerOwinContext(ApplicationDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
  
          // Configure the application for OAuth based flow
          PublicClientId = "self";
          OAuthOptions = new OAuthAuthorizationServerOptions
          {
              TokenEndpointPath = new PathString("/Token"),
              Provider = new ApplicationOAuthProvider(PublicClientId),
              AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              // In production mode set AllowInsecureHttp = false
              AllowInsecureHttp = true
          };
  
          // Enable the application to use bearer tokens to authenticate users
          app.UseOAuthBearerTokens(OAuthOptions);
      }
  }
  </code></pre>
  
  <p>Thank you and please let me know if there's any further information that would be useful.</p>