title: Web API External Bearer Unauthorized
body: <p>I am trying to call the RegisterExternal method in Web API, after having retrieved a token from facebook.  But I keep getting a 401 Unauthorized from my Web API.  I am not sure I am correctly implementing the logic flow.  My code is;</p>
  
  <p>Ask for supported external login providers;</p>
  
  <pre><code>    public async Task&lt;List&lt;ExternalLoginViewModel&gt;&gt; GetExternalLoginsAsync()
      {
          using (var client = GetNewHttpClient(false))
          {
              var response = await client.GetAsync("api/account/externalLogins?returnUrl=/&amp;generateState=true");
  
              response.EnsureSuccessStatusCode();
  
               return await response.Content.ReadAsAsync&lt;List&lt;ExternalLoginViewModel&gt;&gt;();
          }
      }
  </code></pre>
  
  <p>From this, I am returned a facebook URL.  I follow this and then enter in my facebook username and password.  I return back to my app via a deep link and then try and call the RegisterExternal method in the web API like this, passing the facebook "access token" that is returned.</p>
  
  <pre><code>    public async Task&lt;bool&gt; SendSubmitRegisterExternalAsync(RegisterExternalBindingModel ro, string accessToken)
      {
          using (var client = GetNewHttpClient(true))
          {
              client.DefaultRequestHeaders.Add("Authorization", String.Format("Bearer {0}", accessToken));
  
              HttpResponseMessage response = await client.PostAsJsonAsync("api/Account/RegisterExternal", ro);
              if (response.IsSuccessStatusCode) return true;
  
              var value = await response.Content.ReadAsStringAsync();
              throw new ResponseErrorException(ErrorHelper.GetErrorString(value));
          }
      }
  </code></pre>
  
  <p>I receive 'Unauthorized' every time.  I do not know what is wrong.  My Web API method looks like this, and the class is marked with the [Authorize] attribute.</p>
  
  <pre><code>    [OverrideAuthentication]
      [HostAuthentication(DefaultAuthenticationTypes.ExternalBearer)]
      [Route("RegisterExternal")]
      public async Task&lt;IHttpActionResult&gt; RegisterExternal(RegisterExternalBindingModel model)
      {
          ...
  </code></pre>
  
  <p>I have found three different posts this evening of people asking this exact same question, and in all cases there are no replies, so I am not hopeful but if anyone can shed some light on this it would be great!</p>
  
  <p>EDIT:  I have also changed the method signature to 'allowanonymous' and still get unauthorized!</p>
  
  <pre><code>    [OverrideAuthentication]
      [HostAuthentication(DefaultAuthenticationTypes.ExternalBearer)]
      [AllowAnonymous]
      [Route("RegisterExternal")]
      public async Task&lt;IHttpActionResult&gt; RegisterExternal(RegisterExternalBindingModel model)
      {
  </code></pre>