title: .NET Core Web API key
body: <p>I am developing an application that users can authenticate via username and password and we provide a JWT token that then gets validated on the server.</p>
  
  <p>One thing I would like to add is the ability to have a special API Key (guid) that the users can use when integrating with this application instead of using a username and password.</p>
  
  <p>I am unsure how to do this since the authentication part seems to be a bit of a black box (using Aspnet Identity).</p>
  
  <p>Here is some of my code for the authentication setup.</p>
  
  <p><strong>Startup.cs</strong></p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      // Add framework services.
      services.AddDbContext&lt;OmbiContext&gt;(options =&gt;
          options.UseSqlite("Data Source=Ombi.db"));
  
      services.AddIdentity&lt;OmbiUser, IdentityRole&gt;()
          .AddEntityFrameworkStores&lt;OmbiContext&gt;()
          .AddDefaultTokenProviders();
  
      services.Configure&lt;IdentityOptions&gt;(options =&gt;
      {
          options.Password.RequireDigit = false;
          options.Password.RequiredLength = 1;
          options.Password.RequireLowercase = false;
          options.Password.RequireNonAlphanumeric = false;
          options.Password.RequireUppercase = false;
      });
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory, IMemoryCache cache)
  {
      var tokenOptions = (IOptions&lt;TokenAuthentication&gt;)app.ApplicationServices.GetService(
          typeof(IOptions&lt;TokenAuthentication&gt;));
  
      var ctx = (IOmbiContext)app.ApplicationServices.GetService(typeof(IOmbiContext));
  
      var tokenValidationParameters = new TokenValidationParameters
      {
  
          ValidateIssuerSigningKey = true,
          IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(tokenOptions.Value.SecretKey)),
  
          RequireExpirationTime = true,
          ValidateLifetime = true,
          ValidAudience = "Ombi",
          ValidIssuer = "Ombi",
          ClockSkew = TimeSpan.Zero
      };
  
      app.UseJwtBearerAuthentication(new JwtBearerOptions()
      {
          Audience = "Ombi",
          AutomaticAuthenticate = true,
          TokenValidationParameters =  tokenValidationParameters,
  
      });
   //....
  }
  </code></pre>
  
  <p>The above code works when having the <code>[Authorized]</code> attributes on controllers and checking for the roles and such.</p>
  
  <p>Anyone have any idea how I can pass some sort of <code>Api-Key</code> header on all requests containing this special API Key for it to pass the <code>[Authorized]</code> attributes? (The key is stored in the database.)</p>