title: Web API 2 OAuth Bearer Tokens with Custom Authentication
body: <p>I have the following requirements for my C# Web API 2 Service:</p>
  
  <p>The service authenticates Users by the combination of Email and a temporary Passcode that gets sent to their inbox, as a factor of authentication.
  I need to blend in this authentication mechanism with producing OAuth bearer tokens to secure the service and use standard ASP.NET Authorisation mechanism to check each request against the token via some kind of [Authorize] attribute. </p>
  
  <p>I have successfully implemented these steps</p>
  
  <ol>
  <li>User requests Passcode</li>
  <li>System generates and emails Passcode to User with 30 days expiration</li>
  <li>User authenticates with Email + Passcode</li>
  <li>System checks validity of Passcode</li>
  </ol>
  
  <p>But I am not sure how to begin implementing the remaining steps</p>
  
  <ol start="5">
  <li>If Passcode valid, system generates OAuth bearer token</li>
  <li>OAuth bearer token lasts as long as Passcode expiration date</li>
  <li>Use ASP.NET Identity authorization attributes to perform authentication and authorisation checks</li>
  <li>Use OWIN Security and OAuth Middleware to create token</li>
  <li>Use claims based authorisation and serialise claims into token</li>
  </ol>
  
  <p>The cited process only describes using ASP.NET Identity Individual User accounts as a means to authenticate which is not how I want to authenticate. </p>
  
  <p><a href="http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api" rel="nofollow">http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api</a></p>
  
  <p>I actually need to authenticate by checking Email and Passcode. </p>