IdentityServer4 + Web Api + Spa together in one project
<p>I'm having a hard time trying to build a single project where all those things play nicely together.</p>

<ul>
<li>Spa

<ul>
<li>StaticFiles</li>
</ul></li>
<li>Web API (MVC) 

<ul>
<li>Swagger (Swashbuckle)</li>
</ul></li>
<li>IdentityServer4

<ul>
<li>IdentityServer4.AspNetIdentity</li>
<li>IdentityServer4.EntityFramework</li>
<li>Social Logins</li>
</ul></li>
</ul>

<p>I've started with the IdentityServer4.Samples\Quickstart6_AspNetIdentity code an integrated nuget after nuget.</p>

<pre><code>            // spa
            app.UseDefaultFiles();
            app.UseStaticFiles();

            app.UseCors("any");

            // api
            app.Map(new PathString("/api"), map =&gt;
            {
                map.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
                {
                    Authority = PublicHostUri,
                    ScopeName = ScopeName,
                    ScopeSecret = "secret",

                    RequireHttpsMetadata = PublicHostUri.ToLower().StartsWith("https"),
                    SaveToken = true,
                    EnableCaching = true
                });

                map.UseMvc();

            });
                // sts
                JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

                app.UseIdentity();
                app.UseIdentityServer();

                // Add external authentication middleware below. To configure them please see http://go.microsoft.com/fwlink/?LinkID=532715
                app.UseCookieAuthentication(new CookieAuthenticationOptions
                {
                    AuthenticationScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,

                    AutomaticAuthenticate = false,
                    AutomaticChallenge = false
                });

                app.UseTwitterAuthentication(new TwitterOptions
                {
                    ConsumerKey = "6XaCTaLbMqfj6ww3zvZ5g",
                    ConsumerSecret = "Il2eFzGIrYhz6BWjYhVXBPQSfZuS4xoHpSSyD9PI"
                });

                app.UseGoogleAuthentication(new GoogleOptions
                {
                    AuthenticationScheme = "Google",
                    DisplayName = "Google",
                    SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,

                    ClientId = "434483408261-55tc8n0cs4ff1fe21ea8df2o443v2iuc.apps.googleusercontent.com",
                    ClientSecret = "3gcoTrEDPPJ0ukn_aYYT6PWo"
                });                          

            app.UseMvc(routes =&gt;
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });           

            app.UseSwagger();
            app.UseSwaggerUi();
</code></pre>

<p>I'm struggling to isolate the Web API part in such a way that the bearer AuthenticationScheme is the only Authentication thats active in the /api pipeline.</p>

<p>Right now all of the added AuthenticationSchemes like Cookies, Google, Twitter, OIDC, Bearer are used for the /api Route.</p>

<p>What do I miss? Why does /api not only uses the UseIdentityServerAuthentication aka bearer token scheme?</p>

<p>Update: I've shared the working proof of concept code here <a href="https://github.com/ChrisRichner/CoreWebApp.Quickstart" rel="nofollow">https://github.com/ChrisRichner/CoreWebApp.Quickstart</a></p>