title: Best way to secure ASP.NET Web API 2 where multiple client use it
body: <p>What is the best way to secure a Web API when you have multiple different clients to use? Each client should have its own API key to connect with.
  Now I have read different things but I still have some questions.</p>
  
  <p>I have found this one: <a href="http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/#comments" rel="nofollow noreferrer">http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/#comments</a> but is it sufficient?</p>
  
  <p>So basically:</p>
  
  <ol>
  <li>client connects with given username/password</li>
  <li>client gets a bearer token back</li>
  <li>client uses this token in each post to the api until the timestamp is over</li>
  </ol>
  
  <p>I also have read about giving a API Secret key to each client which he can uses: <a href="http://bitoftech.net/2014/12/15/secure-asp-net-web-api-using-api-key-authentication-hmac-authentication/" rel="nofollow noreferrer">http://bitoftech.net/2014/12/15/secure-asp-net-web-api-using-api-key-authentication-hmac-authentication/</a></p>
  
  <p>What is the best approach?</p>