title: Architecture Token Authentication: Web API, Xamarin and External Authentication
body: <p><strong>Background</strong></p>
  
  <p>I'm developing an app using Xamarin (app) and a Web API (Endpoints). The app does not implement its own authentication and it uses External Authentication (Google, Facebook, Twitter). Xamarin has something to deal with External Authentication called <code>Xamarin.Auth</code>.   </p>
  
  <p><strong>Question</strong></p>
  
  <p>I understand how <code>Xamarin.Auth</code> works and how to store the access token. But I still have some questions that I didn't find answers for.</p>
  
  <ol>
  <li><p>How would my Web API will know it has authenticated and now should allow to access the endpoints?</p></li>
  <li><p>Should i still need the Token Authentication mechanism in place for my app and API to communicate securely?</p></li>
  <li><p>Can i use the same token created by external authentication service and store in database and use it to communicate between ? If so how would i encounter situation where token is not valid?</p></li>
  </ol>
  
  <p><strong>UPDATE 1</strong></p>
  
  <p>I still have some confusion and questions regarding the workflow, so created a diagram.</p>
  
  <p><a href="https://i.stack.imgur.com/00CHh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/00CHh.png" alt="enter image description here"></a></p>
  
  <ol>
  <li>oAuth 2.0(Google,Facebook,others).</li>
  <li>Client receives token from External Authentication.</li>
  <li>Client calls the API. <strong>At this stage how would API knows that Authentication has been done?</strong> <strong>Does client send back the token to API?</strong></li>
  <li>If Client does send the token. <strong>How would API know it is the valid token?</strong> and <strong>When it will be expired?</strong></li>
  <li><strong>Can someone please explain this kind of workflow between API and Client after Authentication?</strong></li>
  </ol>