Protecting an API using Client Credentials

This quickstart presents the most basic scenario for protecting APIs using IdentityServer.

In this scenario we will define an API and a client that wants to access it. The client will request an access token at IdentityServer and use it to gain access to the API.

Defining the API

Scopes define the resources in your system that you want to protect, e.g. APIs.

Since we are using the in-memory configuration for this walkthrough - all you need to do to add an API, is to create an object of type ApiResource and set the appropriate properties.

Add a file (e.g. Config.cs) into your project and add the following code:

public static IEnumerable<ApiResource> GetApiResources()
    return new List<ApiResource>
        new ApiResource("api1", "My API")

Defining the client

The next step is to define a client that can access this API.

For this scenario, the client will not have an interactive user, and will authenticate using the so called client secret with IdentityServer. Add the following code to your configuration:

public static IEnumerable<Client> GetClients()
    return new List<Client>
        new Client
            ClientId = "client",

            AllowedGrantTypes = GrantTypes.ClientCredentials,

            // secret for authentication
            ClientSecrets =
                new Secret("secret".Sha256())

            // scopes that client has access to
            AllowedScopes = { "api1" }

Configure IdentityServer

To configure IdentityServer to use your scopes and client definition, you need to add code to the ConfigureServices method. You can use convenient extension methods for that - under the covers these add the relevant stores and data into the DI system:

public void ConfigureServices(IServiceCollection services)
    // configure identity server with in-memory stores, keys, clients and resources

That’s it - if you run the server and navigate the browser to http://localhost:5000/.well-known/openid-configuration, you should see the so-called discovery document. This will be used by your clients and APIs to download the necessary configuration data.


Adding an API

Next, add an API to your solution.

You can use the ASP.NET Core Web API template. Again, we recommend you take control over the ports and use the same technique as you used to configure Kestrel and the launch profile as before. This walkthrough assumes you have configured your API to run on http://localhost:5001.

The controller

Add a new controller to your API project:

public class IdentityController : ControllerBase
    public IActionResult Get()



The last step is to add the authentication services to DI and the authentication middleware to the pipeline. These will:

  • validate that the token is valid to be used with this api (aka scope)

Add the IdentityServer4.AccessTokenValidation NuGet package to your project.


Update Startup to look like this:

public class Startup
    public void ConfigureServices(IServiceCollection services)

            .AddIdentityServerAuthentication(options =>
                options.Authority = "http://localhost:5000";
                options.RequireHttpsMetadata = false;

                options.ApiName = "api1";

    public void Configure(IApplicationBuilder app)


AddAuthentication adds the authentication services to DI and configures "Bearer" as the default scheme. AddIdentityServerAuthentication adds the IdentityServer access token validation handler into DI for use by the authentication services. UseAuthentication adds the authentication middleware to the pipeline so authentication will be performed automatically on every call into the host.

If you use the browser to navigate to the controller (http://localhost:5001/identity), you should get a 401 status code in return. This means your API requires a credential.

That’s it, the API is now protected by IdentityServer.

Creating the client

The last step is to write a client that requests an access token, and then uses this token to access the API. For that, add a console project to your solution (see full code here).


Add the IdentityModel NuGet package to your application.



// discover endpoints from metadata
var disco = await DiscoveryClient.GetAsync("http://localhost:5000");

Next you can use the TokenClient class to request the token. To create an instance you need to pass in the token endpoint address, client id and secret.

Next you can use the RequestClientCredentialsAsync method to request a token for your API:

// request token
var tokenClient = new TokenClient(disco.TokenEndpoint, "client", "secret");
var tokenResponse = await tokenClient.RequestClientCredentialsAsync("api1");

if (tokenResponse.IsError)




The last step is now to call the API.


// call api
var client = new HttpClient();

var response = await client.GetAsync("http://localhost:5001/identity");
if (!response.IsSuccessStatusCode)
    var content = await response.Content.ReadAsStringAsync();

The output should look like this:




Further experiments

This walkthrough focused on the success path so far

  • client was able to request token
  • client could use the token to access the API


  • try to ask for an invalid scope during the token request
  • don’t send the token to the API