title: Authenticating via http using the web api in asp.net
body: <p>I've watched and viewed lots of pages on securing asp.net web api's - including: <a href="http://weblogs.asp.net/jgalloway/archive/2012/03/23/asp-net-web-api-screencast-series-part-6-authorization.aspx">http://weblogs.asp.net/jgalloway/archive/2012/03/23/asp-net-web-api-screencast-series-part-6-authorization.aspx</a> and <a href="http://weblogs.asp.net/jgalloway/archive/2012/05/04/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way.aspx">http://weblogs.asp.net/jgalloway/archive/2012/05/04/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way.aspx</a> - however, I've not yet seen a KISS type example.</p>
  
  <p>If I have a web api, which returns a list of cars for example - and I am working with a 3rd party (ie. not my own website or server/domain) who wants to query (get) and insert (post) lists of cars by a type, into my database, how so I authenticate them (via https)?</p>
  
  <p>Do they simply add (into their JSON GET/Post) something like:</p>
  
  <pre><code>[
  {"username":"someusername","password":"somepassword",
  {
  "carTypeID":12345,
  "carTypeID":9876}
  "carTypeID":2468}
  }
  }
  ]
  </code></pre>
  
  <p>I can then grab the username and password, and check against my membership database in .net, and "IfUserAuthenticated" go on to process the rest of the JSON?</p>
  
  <p>Or is there a better way of doing this?  I've heard of adding details to headers etc - but I'm not sure if that's for a reason, or over complicating it.  I've also heard of setting tokens which are sent back to the 3rd party - if that's the best method, what instructions do I give them got building their side of the app that will use my API?</p>
  
  <p>Thanks for any advice/pointers,</p>
  
  <p>Mark</p>