How to get bearer token as http response from asp.net

I would consider a combination of JWT/Owin. Basically, you need a mechanism that will issue tokens (OAuth) after successful login and then you need a middleware that will consume the token bearer from any subsequent request's http header and grant(or deny) the access (using standard [Authorize] decorator). Here is very nice example of how to use JWT (Json Web Tokens).

If you're not familiar with OWIN/Katana itself there are very nice articles on official website. It will be very useful. You will basically just need two OWIN middlewares, the UseOAuthAuthorizationServer and UseJwtBearerAuthentication which comes from a few NuGet packages. Just follow the example above.

Only to be complete here, you mention storing the token beares in native mobile application, make sure you store them on appropriate locations either in Android or iOS.

On my Phone Apps I call server side APIs using https. I have provided sample code here of how I authorize users...this code has been modified so as not to show my actual process. You'll have to modify it to meet your needs. But it does show an approach that calls web services only.

On your Service Side create the following Attribute:

using System.Text; using System.Security.Cryptography; using System.Web.Http.Filters; using System.Web.Http.Controllers; using System.Net.Http; public class RequireHttpsAttribute : AuthorizationFilterAttribute { public override void OnAuthorization(HttpActionContext actionContext) { if (actionContext.Request.RequestUri.Scheme !=Uri.UriSchemeHttps) { actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden) { ReasonPhrase = "HTTPS Required" }; } else { string UserName; String Password; if (actionContext.Request.Headers.Any(p => p.Key == "UserName") && actionContext.Request.Headers.Any(p => p.Key == "UserName")) { UserName = actionContext.Request.Headers.Where(p => p.Key == "UserName").FirstOrDefault().Value.FirstOrDefault(); Password = actionContext.Request.Headers.Where(p => p.Key == "UserName").FirstOrDefault().Value.FirstOrDefault(); //do authentication stuff here.. If(Authorized()) { base.OnAuthorization(actionContext); return; } Else { actionContext.Response = new HttpResponseMessage (System.Net.HttpStatusCode.Forbidden) { ReasonPhrase = "Invalid User or Password" }; } } actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden) { ReasonPhrase = "HTTPS Required" }; } } return ReasonPhrase; } 

On your client side make request like this:

string ResponseText= String.Empty(); using (var client = new HttpClient()) { client.BaseAddress = new Uri("https://YOURAPI/"); client.DefaultRequestHeaders.Accept.Clear(); //client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue ("text/json")); client.DefaultRequestHeaders.Accept.Add( new MediaTypeWithQualityHeaderValue("application/json")); client.DefaultRequestHeaders.Add("UserName", UserName); client.DefaultRequestHeaders.Add("Password", Password); // New code: HttpResponseMessage response = await client.GetAsync ("api/YOURAPIENDPOINT").ConfigureAwait(continueOnCapturedContext: false); if (response.IsSuccessStatusCode) { ResponseText = await response.Content.ReadAsStringAsync(); } } 

The API method should look something like this:

 [RequireHttps] public YOURAPI Get(int id) { //if you got this far then the user is authorized. } 

Your mileage may vary. I have not tested this code as modified. But you should get the idea of how to accomplish what you want.