php - ASP.NET authentication for custom API -

i know pretty discussed topic i'm struggling in finding solution case.

i have done working api service in asp.net (c# 4.5.1). clients uses php pages call page.aspx on server , sending via post string. string contains id , cypher message. every user have different key (aes 256) and, since have id db correct key decypher message , request contains. check ip, every client have list of approved ips (when not using debug mode testing)

i method have let users purchases. implemented (thank paypal) , works, feel security weak.

so wanted add already known , already wrapped authentication system, without re-writing of working , debugged code.

since used lot of big internet services thought oauth 2.0 (and i know nothing it), looks talks creating login uses services facebook, google, twitter , go on.. not case. have my own database my user list , need know 100% security calling api service.

i tried creating new web api 2 project (mvc.. damn) cannot understand if can use service without rewriting logic api calling (and saw looks no answer)

so question is: authentication method can use easy implement without rewriting already working code , can usable clients php?

i watching "asp.net mvc 5 fundamentals" tutorial on pluralsight scott allen explains quite nicely. before watching tutorial, 1 app worked on, had table in database tokens issues @ login. client send token request. @ server side, did custom attribute called [checktoken] inside check if token exists in database , if stil valid (not expired, etc.) went step further , swap token if token gets stolen, not valid long. way, user not have keep login in time.