API first websites are very popular now thanks to client heavy frameworks like Angular. Securing them properly has always been a challenge, especially if you want to expose your API to third party developers as well. Join me as I show you how to secure your API, connect an Angular SPA, and even expose your API to third parties using OAuth. This is a demo heavy talk with practical implementations of Identity Server 4 in an ASP.NET Core app as a token server, Entity Framework and ASP.NET Identity for security, ASP.NET Core MVC for an API and an Angular SPA application.