My team has developed an API and I've been tasked with creating an authentication layer that allows partners' applications to consume it. To that end, I've created a data store which houses an Application ID, Login and salted/hashed Password for that application to authenticate against. I want to hand back a Token for them to use (which is a key for session information that is kept on the server). The process to generate the Token is below. I have another process which reverses this to validate its authenticity. It seems to stand up to testing, but I'd like to know if there's anything else that should be done to make this properly secure.private const string Password = nottheactualpasswordthatisused..;private static readonly byte[] _Salt ={    0x00, 0x01, 0x02, 0x03,    0x04, 0x05, 0x06, 0x07,    0x08, 0x09, 0x0a, 0x0b,    0x0c, 0x0d, 0x0e, 0x0f};private static async Task<string> CreateSecureSessionTokenAsync(int applicationId, DateTime createDate){    using (var aes = Aes.Create())    {        if (aes == null)        {            return null;        }        using (var deriveBytes = new Rfc2898DeriveBytes(Password, _Salt))        {            aes.Key = deriveBytes.GetBytes(32);            aes.IV = deriveBytes.GetBytes(16);        }        using (var encryptor = aes.CreateEncryptor())        using (var memoryStream = new MemoryStream())        {            using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))            using (var writer = new StreamWriter(cryptoStream))            {                await writer.WriteLineAsync(Convert.ToString(applicationId)).ConfigureAwait(false);                await writer.WriteLineAsync(Convert.ToString(createDate, CultureInfo.InvariantCulture))                    .ConfigureAwait(false);            }            return Convert.ToBase64String(memoryStream.ToArray());        }    }}
Secure Token for use in API calls
c#;security;api;authentication