As per Dominick Baier's Pluralsight Course "Web API v2 Security"