title: Securing Web API /Token Endpoint
body: <p>I have a Web API project that follows the basic account authentication process outlined here: <a href="http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api" rel="nofollow">http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api</a>. My question is should I secure the /Token enpoint with SSL (or something else)? Otherwise, the  API call to "myURL/Token" is just sent via clear text with the username and password in its body?</p>
  
  <p>I read up this post on Web API SSL: <a href="http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-api" rel="nofollow">http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-api</a> but I don't know where I should place the [RequireHttps] attribute since the /Token enpoint is not really a controller action.</p>
  
  <p>Thanks for any guidance you can provide!</p>