For those who don't know it, Postman is a lightweight REST client that can be used to test basically any HTTP API; in our specific scenario, we can use it to send custom GET, POST, PUT, or DELETE HTTP requests to our app and see how our server-side .NET Core controllers will handle them.

Once installed, run the application (or the Chrome extension) and wait for the animated splash screen to take its course; right after that, you'll be presented with a welcome screen, when you'll be asked to sign up for a free account or go straight to the app. Registration isn't mandatory to do what we have to do, so we're free to choose what we want; both routes will eventually take us to the main application screen.

From there, we can set up a basic POST HTTP request to test our TokenController in the following way:

• Select the Builder tab from the top of the main screen; a multi-panel, browser-like window should appear, with something resembling an address bar near the upper panel's top and a flat tab panel right below it.
• Select POST from the drop-down list to the left of the address bar, then type in the following address to the immediate right: http://localhost:<port>/api/token/auth. Do not press Enter and don't click on the Send button yet.
• Select Body from the tab panel just below the address bar; a checkbox list should appear. Activate the raw checkbox, and then select JSON (application/json) from the drop-down list to the right.
• Type the following code within the text area right below the checkbox list:

{
  "username":"Admin",
  "password":"Pass4Admin",
  "grant_type":"password"
}

If we did everything correctly, our Postman screen should look just like the one depicted in the following screenshot:

If everything is looking good, switch to Visual Studio, run the project in debug mode, and wait for the Home view to appear; as soon as you see the quiz listings, switch back to Postman and click on the blue Send button to the right of the address bar and look to the Response panel. If everything worked out well, we should be able to see our JWT Token wrapped in a JSON object:

{
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJsb2NhbGhvc3QiLCJzdWIiOiJBZG1pbiIsImp0aSI6ImViMTQxOGFiLTRhMzgtNGIxNS1iMzA4LWY0ZmIwODI2NDZiZiIsImlhdCI6MTUwNDUwMDM3NSwibmJmIjoxNTA0NTAwMzc1LCJleHAiOjE1MDQ1MDM5NzV9.2XFA3Y243Tpfr_c_NusduQvdHLztt2vevzttd_Y5YnI",
    "expiration": 60
}

This is the HTTP response body returned by the Auth() action method of our TokenController; we can also take a look at the headers by selecting the appropriate tab within that screen.

In the unlikely case that we're not getting the expected result, we can use the server-side debug features of Visual Studio to see what happens behind the scenes until we figure it out.

As soon as we're done with Postman, we can finally switch to the other REST client we're expected to connect our ASP.NET Identity service with--our beloved Angular SPA.