# Microsoft.Owin.Security.OAuth

**Kind:** Service

**Source:** `Pams/API/Pams.API/Pams.API.csproj` (line 1)

**Part of:** [Pams](subsystem-pams)

NuGet package dependency

`Microsoft.Owin.Security.OAuth` is a NuGet package dependency declared in `Pams.API.csproj`. It supports OAuth middleware in the legacy-format `Pams.API` project, handling token requests and access-token responses configured by the OWIN startup pipeline.

## Diagram

```mermaid
sequenceDiagram
    participant Client
    participant API as Pams.API
    participant OAuth as Microsoft.Owin.Security.OAuth

    Client->>API: POST token request
    API->>OAuth: Pass request to OAuth middleware
    OAuth-->>API: Create token response
    API-->>Client: Return access token
```

## Usage

```ts
const apiBaseUrl = process.env.PAMS_API_URL;

const response = await fetch(`${apiBaseUrl}/token`, {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
  },
  body: new URLSearchParams({
    grant_type: "password",
    username: "user@example.com",
    password: "password",
  }),
});

if (!response.ok) {
  throw new Error("OAuth token request failed");
}

const token = await response.json();

const apiResponse = await fetch(`${apiBaseUrl}/api/resource`, {
  headers: {
    Authorization: `${token.token_type} ${token.access_token}`,
  },
});
```

## AI Coding Instructions

- Keep OAuth middleware configuration in the OWIN startup pipeline that hosts `Pams.API`.
- Match client token requests to the token endpoint and grant types configured by the API.
- Do not hard-code credentials or access tokens in client code; load them from the calling environment.
- Check token request failures before sending authenticated requests to API endpoints.