api.cs

public class WebSocketAuth : ActionFilterAttribute
{
    // stored access token usually retrieved from any storage
    // implemented thought OAuth or any other identity protocol
    private const string access_token = "821e2f35-86e3-4917-a963-b0c4228d1315";

    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        // retrieve access token from query string
        var sAccess_token = HttpUtility.ParseQueryString(
            actionContext.Request.RequestUri.Query)["access_token"];

        // show case only: easy comparison of tokens 
        if (sAccess_token != access_token)
            throw new UnauthorizedAccessException();
    }
}