If you choose not to use these libraries, you still will need to validate access tokens being passed into your web API. We ...

If you choose not to use these libraries, you still will need to validate access tokens being passed into your web API.  We highly recommend using a reputable token validation to secure your web API.  These API's, like our OWIN and Passport libraries, do primarily three tasks.  They check to make sure your token is well formed, it is being issued by the correct authority and has a valid signature, and that the claims inside the token are intended for your application. You can read more about validating tokens at the link below.