title: Allow API to be used by external applications
body: <p>I have a Angular 8 + Asp.Core application and added JWT authentication on existing user database
  I want to share one Api controller for outside access (PHP site),but not to all controllers.
  How to create a second token and give it access only for a single controller?</p>
  
  <p>A simple solution is to send a security key with request data and check if that key exists in database,but I don't know how secure it is</p>
  
  <p>my current code:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
  .............
   var appSettings = appSettingsSection.Get&lt;UserSettings&gt;();
              var key = Encoding.ASCII.GetBytes(appSettings.Secret);
  
              services.AddAuthentication(x =&gt;
              {
                  x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              })
              .AddJwtBearer(x =&gt;
              {
                  x.RequireHttpsMetadata = false;
                  x.SaveToken = true;
                  x.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateIssuerSigningKey = true,
                      IssuerSigningKey = new SymmetricSecurityKey(key),
                      ValidateIssuer = false,
                      ValidateAudience = false,
                      ValidateLifetime = true,
                      ClockSkew = TimeSpan.Zero
                  };
              });
  }
  
  
  [Authorize]
          public class OtherController : Controller
          {....
  </code></pre>
  
  <p>login controller:</p>
  
  <pre><code>  [AllowAnonymous]
           public class LoginController : Controller
                  {
                      private readonly Entities db;
                      private readonly UserSettings appSettings;
  
                      public LoginController(Entities _db, IOptionsSnapshot&lt;UserSettings&gt; _appSettings)
                      {
                          db = _db;
                          appSettings = _appSettings.Value;
  
                      }
  
                      [Route("/api/login")]
                      [HttpPost]
                      public IActionResult Login([FromBody] LoginData logindata)
                      {
                          var user = db.HT_USERS
                            .SingleOrDefault(u =&gt; u.USERNAME == logindata.Username &amp;&amp; 
          DecryptString128Bit(u.PASSW, "passwkey") == logindata.Password);
                          if (user == null)
                          {
                              return NotFound();
                          }
                          else
                          {
  
                              var tokenHandler = new JwtSecurityTokenHandler();
                              var key = Encoding.ASCII.GetBytes(appSettings.Secret);
                              var tokenDescriptor = new SecurityTokenDescriptor
                              {
                                  Subject = new ClaimsIdentity(new Claim[]
                                  {
                                    new Claim(ClaimTypes.NameIdentifier , user.ID.ToString())
                                  }),
                                  Expires = DateTime.UtcNow.AddDays(7),
                                  SigningCredentials = new SigningCredentials(
                                  new SymmetricSecurityKey(key),
                                  SecurityAlgorithms.HmacSha256Signature)
                              };
  
  
                              var token = tokenHandler.CreateToken(tokenDescriptor);
                              var tokenString = tokenHandler.WriteToken(token);
  
                              return Ok(new
                              {
                                  username = user.NAME,
                                  token = tokenString
                              });
  
                          }
                      }
                  }
  </code></pre>