var oAuthOptions = new OAuthAuthorizationServerOptions
{
    TokenEndpointPath = new PathString("/token"),
    AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(accessTokenExipreMinutes),
    Provider = new AuthorizationServerProvider(),
    AllowInsecureHttp = allowInsecureHttp
};

appBuilder.UseOAuthBearerTokens(oAuthOptions);

class AuthorizationServerProvider : OAuthAuthorizationServerProvider
{
    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
    {
        context.TryGetFormCredentials(out string clientId, out string clientSecret);

        var result = Validate(clientId, clientSecret);
        if (result)
        {
            context.Validated(clientId);
            return;
        }

        context.Rejected();
    }

    public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        try
        {
            ClaimsIdentity oAuthIdentity = new ClaimsIdentity(context.Options.AuthenticationType);
            var props = new AuthenticationProperties();
            var ticket = new AuthenticationTicket(oAuthIdentity, props);

            context.Validated(ticket);
        }
        catch (Exception ex)
        {
            context.Rejected();
        }

        return Task.FromResult(true);
    }
}