# Microsoft.Owin.Security.OAuth

**Kind:** Service

**Source:** `Pams/Logic/Pams.Business/Pams.Business.csproj` (line 1)

**Part of:** [Pams](subsystem-pams)

NuGet package dependency

Microsoft.Owin.Security.OAuth is a NuGet package dependency declared in `Pams.Business.csproj`. It contains OWIN OAuth security components that a hosting application can reference to process authorization requests, validate credentials, and authenticate token-based requests.

## Diagram

```mermaid
sequenceDiagram
    participant Client
    participant Host as OWIN Host
    participant OAuth as Microsoft.Owin.Security.OAuth
    participant Business as Pams.Business

    Client->>Host: Send protected request
    Host->>OAuth: Invoke OAuth middleware
    OAuth->>Business: Validate token or authorization request
    Business-->>OAuth: Return identity or authorization result
    OAuth-->>Host: Return authentication result
    Host-->>Client: Return response
```

## Usage

```typescript
async function requestAccessToken(username: string, password: string) {
  const response = await fetch("/token", {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
    },
    body: new URLSearchParams({
      grant_type: "password",
      username,
      password,
    }),
  });

  if (!response.ok) {
    throw new Error("Token request failed");
  }

  const token = await response.json();

  return token.access_token;
}

const accessToken = await requestAccessToken("user", "password");

const response = await fetch("/api/resource", {
  headers: {
    Authorization: `Bearer ${accessToken}`,
  },
});
```

## AI Coding Instructions

- Treat `Microsoft.Owin.Security.OAuth` as a package dependency; OAuth middleware configuration belongs in the OWIN host startup code, not in the project file.
- Keep token validation and credential checks in the configured OAuth provider callbacks.
- Match the token endpoint path, grant type, and authentication scheme used by the hosting application.
- Do not expose client secrets, passwords, or access tokens in browser code, logs, or source control.

## Used by

3 references from 3 files. Each is a place in this repository where the symbol is actually used — go read one rather than trusting an example.

### Injected or called by (3)

- `Pams.API` — `Pams/API/Pams.API/Pams.API.csproj`:1
- `Pams.Security` — `Pams/Core/Pams.Security/Pams.Security.csproj`:1
- `Pams.Business` — `Pams/Logic/Pams.Business/Pams.Business.csproj`:1