/// <summary>
    /// Class for useful helpers for interacting with IdentityServer
    /// </summary>
    public class TokenTools
    {
        private readonly ITokenService _tokenCreation;
        private readonly ISystemClock _clock;

        /// <summary>
        /// Initializes a new instance of the <see cref="IdentityServerTools" /> class.
        /// </summary>
        /// <param name="contextAccessor">The context accessor.</param>
        /// <param name="tokenCreation">The token creation service.</param>
        /// <param name="clock">The clock.</param>
        public TokenTools(ITokenService defaultTokenService, ISystemClock clock)
        {
            _tokenCreation = defaultTokenService;
            _clock = clock;
        }

        /// <summary>
        /// Issues a JWT.
        /// </summary>
        /// <param name="lifetime">The lifetime.</param>
        /// <param name="issuer">The issuer.</param>
        /// <param name="claims">The claims.</param>
        /// <returns></returns>
        /// <exception cref="System.ArgumentNullException">claims</exception>
        public virtual async Task<string> IssueReferenceToken(int lifetime, string issuer, IEnumerable<Claim> claims)
        {
            if (String.IsNullOrWhiteSpace(issuer)) throw new ArgumentNullException(nameof(issuer));
            if (claims == null) throw new ArgumentNullException(nameof(claims));

            var token = new Token
            {
                Audiences = new string[] { "my_api" },
                ClientId = "pat_client",
                CreationTime = _clock.UtcNow.UtcDateTime,
                Issuer = issuer,
                Lifetime = lifetime,
                Type = OidcConstants.TokenTypes.AccessToken,
                AccessTokenType = AccessTokenType.Reference,
                Claims = new HashSet<Claim>(claims, new ClaimComparer())
            };

            var handle = await _tokenCreation.CreateSecurityTokenAsync(token);

            return handle;
        }
    }

    new Client
                {
                    ClientId = "pat_client",
                    ClientName = "Personal Access Token Public Client",
                    AllowedScopes =
                    {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        "my_api"
                    },
                    AccessTokenType = AccessTokenType.Reference
                 },

public async Task<IActionResult> Index()
        {
            string subject = HttpContext.User.GetSubjectId();
            // customized GrantStore method to get all PATs
            var pats = await referencetokenStore.GetGrantsAsync(subject);

            return View(pats);
        }

public async Task<IActionResult> Create(string shortName, DateTime expiration)
        {
            double PatExpires = (expiration - DateTime.UtcNow).TotalSeconds;
            if (PatExpires > int.MaxValue)
            {
                // correctly adjust for int overflow
                // int.MaxValue; // 68 years, maximum
                PatExpires = int.MaxValue;
            }

            // todo: Support multiple clients?
            var clientId = "pat_client";
            var scopes = "my_api";
            var issuer = "xxx";

            var tokenMeta = $"{shortName}-{DateTime.UtcNow.ToShortDateString()}-{DateTime.UtcNow.AddSeconds(PatExpires).ToShortDateString()}";

            IEnumerable<Claim> claims = new Claim[] {
                // user subject
                new Claim(JwtClaimTypes.Subject, HttpContext.User.GetSubjectId()),
                new Claim(JwtClaimTypes.Scope, scopes),
                // what auth was made? pat, custom value by anders
                new Claim("amr", "pat"),
                new Claim("token_meta", tokenMeta)
                // etc
            };
            var token = await _tools.IssueReferenceToken((int)PatExpires, issuer, claims);

            var msg = $@"This is your Personal Access Token (PAT). It will only be shown once: 
{tokenMeta}--{token}";
            return Content(msg);
        }

        public async Task<IActionResult> Remove() { // ommitted for brevity}

    /// <summary>
    /// Customized ReferenceTokenStore to handle
    /// </summary>
    public class CustomReferencetokenStore : DefaultReferenceTokenStore
    {
        private readonly IPersistedGrantStore store;

        public CustomReferencetokenStore(IPersistedGrantStore store, IPersistentGrantSerializer serializer, IHandleGenerationService handleGenerationService, ILogger<DefaultReferenceTokenStore> logger) : base(store, serializer, handleGenerationService, logger)
        {
            this.store = store;
        }

        /// <summary>
        /// Get all grants by subject
        /// </summary>
        /// <param name="subject"></param>
        /// <returns></returns>
        internal async Task<IEnumerable<PersistedGrant>> GetGrantsAsync(string subject)
        {
            var all = await store.GetAllAsync(subject);
            return all;
        }

        /// <summary>
        /// Gets a Token using the handle format but allow the "--" format
        /// </summary>
        /// <param name="handle"></param>
        /// <returns></returns>
        protected override Task<Token> GetItemAsync(string handle)
        {
            // clean up our metainfo
            if(handle.Contains("--"))
            {
                handle = handle.Split("--")[1]; // skip metadata before --
            }
            return base.GetItemAsync(handle);
        }

        // ommitted for brevity

services.AddIdentityServer(options => {
                // Allow extra space for descriptions in our custom reference token handles
                options.InputLengthRestrictions.TokenHandle = 150; // default is 100
            })

//config.cs
services.AddTransient<CustomReferencetokenStore>();
services.AddTransient<IReferenceTokenStore, CustomReferencetokenStore>();

// use our persistance of grants
services.AddTransient<IPersistedGrantStore, PersistedGrantStore>();

            app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
            {
                Authority = "yourserver.io"
                ClientId ="my_api",
                ClientSecret = "my_api_secret",
                ValidationMode = ValidationMode.Both // default value
            });