I spent the last three years building application back-ends using Web APIs so that arbitrary client technologies can consume them. This creates a number of interesting challenges around authentication and authorization. Embracing token-based authentication, claims and the OAuth2 design patterns simplified many of the complex scenarios. This talk illustrates which tools we have built to make our lifes easier and what works well and what doesn’t - together with some war stories and tips from the trenches.