title: Using multiple Authorization schemes (HMAC and OATH)
body: <p>Okay so i have a WebAPI Auth service that is used for the /token request and returns the Bearer token to the client, i have added an AppId and Api Key to the properties so i get back</p>
  
  <pre><code>{
  "access_token": "...",
  "token_type": "bearer",
  "expires_in": 86399,
  "dm:appid": "1",
  "dm:apikey": "...",
  ".issued": "Wed, 01 Jul 2015 20:46:45 GMT",
  ".expires": "Thu, 02 Jul 2015 20:46:45 GMT"
  }
  </code></pre>
  
  <p>The AppId and Api Key should be used by the client to generate a Hmac SHA256 signature for each request.</p>
  
  <p>On my controller i have used the Authorize attribute and created a HmacAuthentication attribute which implement IAuthenticationFilter</p>
  
  <pre><code>[RoutePrefix("api/account")]
  [Authorize]
  [HmacAuthentication]
  public class AccountController : ApiController
  {
      // rest of controller here
  }
  </code></pre>
  
  <p>The issue i have is that any request to this controller will expect the <code>Authorization: Bearer ...</code> header and the HmacAuthentication attribute also expects the <code>Authorization: amx</code> header.</p>
  
  <p>Now i know that you can only have one Authorization header so my quandry is how can i implement both Authorization headers without breaking HTTP, has anyone achieved the use of both OWIN OAuth and HMAC Authentication</p>
  
  <p>I followed these examples from Taiseer Joudeh</p>
  
  <p><a href="http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/" rel="nofollow">Token Based Authentication using ASP.NET Web API 2, Owin, and Identity</a>
  <a href="http://bitoftech.net/2014/12/15/secure-asp-net-web-api-using-api-key-authentication-hmac-authentication/" rel="nofollow">Secure ASP.NET Web API using API Key Authentication – HMAC Authentication</a></p>