title: MVC .NET cookie authenticated system acessing a Web Api with token authentication
body: <p>I have a Mvc 5 client that have a Ownin cookie authentication. 
  I also have a Web Api that is protected with Owin Bearer token (I used the VS2013 Web Api template, that create the Token endpoint)</p>
  
  <p>Ok, now my Mvc 5 client need to use my WebApi.
  I created a method to get the bearer token:</p>
  
  <pre><code>internal async Task&lt;string&gt; GetBearerToken(string siteUrl, string Username, string Password)
  {
       HttpClient client = new HttpClient();
  
       client.BaseAddress = new Uri(siteUrl);
       client.DefaultRequestHeaders.Accept.Clear();
  
       HttpContent requestContent = new StringContent("grant_type=password&amp;username=" + Username + "&amp;password=" + Password, Encoding.UTF8, "application/x-www-form-urlencoded");
  
       HttpResponseMessage responseMessage = await client.PostAsync("Token", requestContent);
  
       if (responseMessage.IsSuccessStatusCode)
       {
           TokenResponseModel response = await responseMessage.Content.ReadAsAsync&lt;TokenResponseModel&gt;();
           return response.AccessToken;
       }
  
       return "";
  }
  </code></pre>
  
  <p>And in my Mvc action I called that:</p>
  
  <pre><code>public async Task&lt;ActionResult&gt; Index()
  {
       var token = await GetBearerToken("http://localhost:6144/", "teste", "123456");
  
       using (var client = new HttpClient())
       {
           client.DefaultRequestHeaders.Add("Authorization", "Bearer "+ token);
  
           var response = await client.GetAsync("http://localhost:6144/api/values");
  
           if (response.IsSuccessStatusCode)
           {
               var data = response.Content.ReadAsAsync&lt;IEnumerable&lt;string&gt;&gt;();
  
               return Json(data.Result, JsonRequestBehavior.AllowGet);
           }
       }   
  }
  </code></pre>
  
  <p>That all works fine... But I need to use the Web Api in all my actions... 
  So how can I keep that token (despite getting a new token every request) and how verify if it expired ... Is it possible to keep that together with authentication cookie someway?
  Any best pratices to deal with that scenario?</p>
  
  <p>Thanks</p>