When a user signs into my app using an external provider, does he then use the token from that provider to call the app's API or must the app generate its own token?

CodePudding user response：

The token that IdentityServer receives from the external provider is not passed down to the client, instead IdentityServer will issue its own tokens based on the received data in the external token.

The client and API's using IdentityServer only trusts token issued by it, not by the external service. In this way you can have one or many services that IdentityServer trusts, but your client/API only trusts IndentityServer.

Hope that makes things a bit clearer