In the preceding sections, we learnt about different authentication providers to authenticate users and manage them using Identity membership provider. Enterprise applications, however, consist of various APIs and those APIs should be protected so only authenticated users can access them. OAuth is widely used to protect APIs or resources deployed on a server and it provides them with a uniform interface by accepting an access token from consumers and based on its validity, returns a response. OAuth is not good for authentication as anybody having the same access token can access resources. To overcome this scenario, OpenID Connect (OIDC) is introduced, which adds an extension to OAuth and makes it more secure. IdentityServer4 provides the middleware to implement these scenarios in an easy and straightforward way, which we will discuss next.