How to implement REST API with OAuth 2.0 for multiple client access
<p>I have a requirement like below to implement REST API using OAuth 2.0 and Web Api.</p>

<p>REST API should allow 
- to create, update, view and delete orders
- to create, update, view and delete inventories</p>

<p>API should be able to used by any type of external client such as web application, mobile application, windows/web services, etc.</p>

<p>Roles allowed for external clients : Order Management , Inventory Management
User data (roles, permissions) of external clients will not be managed by our system.</p>

<p><strong>Note:</strong> There can be another two roles like Internal , External. Because delete functions can't be allowed for external users.</p>

<p>Order and Inventory data will be managed in a SQL Server DB which is already used by current windows/desktop applications. Orders, inventories comes via new API should save in same database.</p>

<p><strong>Questions:</strong></p>

<ol>
<li>Which grant type I can use?</li>
<li>How should I mange external client's data (allowed roles, client id, tokens) ? Do I need to use separate membership database for this? Can I used my existing database with new tables for this?</li>
</ol>