title: IdentityServer4 ResourceStore - IdentityResource vs ApiResource
body: <p>I'm trying to setup IdentityServer4 to work with my own (mongodb) database, instead of the in-memory examples shown in the documentation.</p>
  
  <p>To do so I have configured the following services:</p>
  
  <pre><code>builder.Services.AddTransient&lt;IPersistedGrantStore, PersistedGrantStore&gt;();
  builder.Services.AddTransient&lt;IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator&gt;();
  builder.Services.AddTransient&lt;IClientStore, ClientStore&gt;();
  builder.Services.AddTransient&lt;IResourceStore, ResourceStore&gt;();
  </code></pre>
  
  <p>In my databases I've created 4 collections: "ApiResources", "IdentityResources" and "Clients".</p>
  
  <p>In the ApiResources I've defined what should be the API I'm protecting:</p>
  
  <pre><code>{ 
      "Name" : "MyAPI", 
      "DisplayName" : "Test API Resource"
  }
  </code></pre>
  
  <p>In IdentityResources I've defined what should be my identities:</p>
  
  <pre><code>{ 
      "Name" : "MyIdentity", 
      "DisplayName" : "Test Identity Resource"
  }
  </code></pre>
  
  <p>And I have defined the following client:</p>
  
  <pre><code>{ 
      "ClientId" : "client", 
      "Enabled" : true, 
      "ClientSecrets" : [
          {
              "Description" : null, 
              "Value" : "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=", 
              "Expiration" : null, 
              "Type" : "SharedSecret"
          }
      ], 
      "ClientName" : null, 
      "ClientUri" : null, 
      "LogoUri" : null, 
      "RequireConsent" : true, 
      "AllowRememberConsent" : true, 
      "AllowedGrantTypes" : [
          "client_credentials"
      ], 
      "AllowedScopes" : [
          "MyAPI"
      ], 
      "Claims" : [
  
      ], 
      "AllowedCorsOrigins" : [
  
      ]
  }
  </code></pre>
  
  <p>My database representation is similar to what is represented in the example in the documentation.</p>
  
  <p>In my <code>IResourceStore</code> implementation, for <code>FindIdentityResourcesByScopeAsync</code> I look for the scopes names in my <code>IdentityResources</code> collection (as the name of the method implies) and in my <code>FindApiResourcesByScopeAsync</code> I look for the scopes in my <code>ApiResources</code> collection as the name implies.</p>
  
  <p>When I try to authenticate the client against the server I'm getting <code>Requested scope not allowed: MyAPI</code>.</p>
  
  <p>But if I change my code in <code>FindIdentityResourcesByScopeAsync</code> to the the <code>ApiResources</code> then it works.</p>
  
  <p>Is this a bug? or do I not get exactly what's the difference between IdentityResources and ApiResources? When should each be used? If in <code>FindIdentityResourcesByScopeAsync</code> I should take my API resource, what should I take in <code>FindApiResourcesByScopeAsync</code>?</p>