title: WebAPI - How to get UserID from token
body: <p>I have WebApi application and added UserID to token in ApplicationOAuthProvider class:</p>
  
  <pre><code>    public override Task TokenEndpoint(OAuthTokenEndpointContext context)
      {
          foreach (KeyValuePair&lt;string, string&gt; property in context.Properties.Dictionary)
          {
              context.AdditionalResponseParameters.Add(property.Key, property.Value);
          }
  
          context.AdditionalResponseParameters.Add("ID", context.Identity.GetUserId&lt;int&gt;());
  
          return Task.FromResult&lt;object&gt;(null);
      }
  </code></pre>
  
  <p>Now how can I get this ID in my controller method?</p>
  
  <p>I try the following:</p>
  
  <pre><code>[Authorize]
  public class ApiEditorialController : ApiController
  {
  
      public HttpResponseMessage GetEditorialRequests()
      {
          int id = HttpContext.Current.User.Identity.GetUserId&lt;int&gt;();
  
          var r = Request.CreateResponse(HttpStatusCode.Accepted);
          r.ReasonPhrase = "Cool!";
          return r;
      }
  
  }
  </code></pre>
  
  <p>But I get NullReferenceException on </p>
  
  <pre><code>int id = HttpContext.Current.User.Identity.GetUserId&lt;int&gt;(); 
  </code></pre>
  
  <p>string....</p>
  
  <p><strong>UPDATE:</strong>
  Look at the Response below (from Francis Ducharme) just override OnAuthorization instead on create private contructor :)</p>
  
  <pre><code>public class AuthorizeApiFilter : AuthorizeAttribute
  {
      public override void OnAuthorization(HttpActionContext actionContext)
      {
          string token = string.Empty;
          AuthenticationTicket ticket;
  
          token = (actionContext.Request.Headers.Any(x =&gt; x.Key == "Authorization")) ? actionContext.Request.Headers.Where(x =&gt; x.Key == "Authorization").FirstOrDefault().Value.SingleOrDefault().Replace("Bearer ", "") : "";
  
          if (token == string.Empty)
          {
              actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized, "Missing 'Authorization' header. Access denied.");
              return;
          }
  
          //your OAuth startup class may be called something else...
          ticket = Startup.OAuthOptions.AccessTokenFormat.Unprotect(token);
  
          if (ticket == null)
          {
              actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.BadRequest, "Invalid token decrypted.");
              return;
          }
  
          // you could perform some logic on the ticket here...
  
          // you will be able to retrieve the ticket in all controllers by querying properties and looking for "Ticket"... 
          actionContext.Request.Properties.Add(new KeyValuePair&lt;string, object&gt;("Ticket", ticket));
          base.OnAuthorization(actionContext);
      }
  }
  </code></pre>
  
  <p>Thank you, Francis Ducharme</p>