title: ASP.NET Core OAuth2.0. Calling external API on behalf of the user
body: <p>sorry for the long question here, but it feels like I googled everything around the topic...</p>
  
  <p>I have <code>OpenID Connect</code> - compatible 3rd-party endpoint (service <code>A</code>) which I want to use as identity provider in my ASP.NET Core MVC application. The service support <code>Implicit</code> and <code>Code Flow</code>. No problem at this moment. Furthermore, I want to be able to call service <code>A</code>'s api on behalf of the logged in user. I know it relatively easy to do from within <code>Controller</code> via:</p>
  
  <pre><code>var token = await HttpContext.GetTokenAsync("access_token");
  var client = new HttpClient();
  client.SetBearerToken(accessToken);
  var content = await client.GetAsync("https://A.com/api");
  </code></pre>
  
  <p>But if I want to distribute such an access between, let's say, few micro-services (or if I want to schedule a background delayed job), some questions appear:</p>
  
  <ol>
  <li>How could i share "access_token" / "refresh_token" in this scenario? Should I handle OAuth events and persist tokens somewhere? Any suggestions on this? </li>
  <li>Where are tokens stored when we specify <code>SaveTokens = true</code> in a middleware?</li>
  </ol>
  
  <p>I appreciate any help on this, seems to be a popular case but not enough info on that across the web. </p>