title: Organizing and securing asp.net web api
body: <p>I am asp.net web api newbie and basically created couple of simple web api's in asp.net. Now trying to add security and more users, and would like to do the following:</p>
  
  <ul>
  <li>create web api</li>
  <li>secure web api with oauth2</li>
  <li>web api would serve to agent/admins, users and guest users</li>
  </ul>
  
  <p>What confuses me is the following</p>
  
  <ul>
  <li><p>should oauth mechanism contain information if a token is issued for admin, user or guest users</p></li>
  <li><p>should api contain different controllers for identical actions
  for example api/agent/orders, api/user/orders, api/guest/orders or should a single controller implement a logic in order to return data based on token information. </p></li>
  </ul>
  
  <p>Not sure if the question is too broad, but would like to know how and when should tokens be properly used and how to organize web api in controllers/actions.</p>