So far, so good. We now have the basic functionality for our stock checker application; that is, it checks stock levels and allows us to update stock levels. However, there is an issue with this. With our example, any of the users would be able to easily update the stock levels. This can (and should) be locked down on the client; however, we should implement this security on the API as well; after all, access to Postman, or even a web browser, is not exclusive, and the last thing we would want is for someone without permission to update our stock levels.
Let's plug in IdentityServer 4 and make sure that the person accessing the API is, at least, authorized to do so.