title: API end point returning "Authorization has been denied for this request." when sending bearer token
body: <p>I've followed a tutorial to protect a Web API with OAuth in C#. </p>
  
  <p>I'm doing some tests and so far I've been able to get the access token successfully from <code>/token</code>. I'm using a Chrome extension called "Advanced REST Client" to test it. </p>
  
  <pre><code>{"access_token":"...","token_type":"bearer","expires_in":86399}
  </code></pre>
  
  <p>This is what I get back from <code>/token</code>. Everything looks good.</p>
  
  <p>My next request is to my test API Controller:</p>
  
  <pre><code>namespace API.Controllers
  {
      [Authorize]
      [RoutePrefix("api/Social")]
      public class SocialController : ApiController
      {
        ....
  
  
          [HttpPost]
          public IHttpActionResult Schedule(SocialPost post)
          {
              var test = HttpContext.Current.GetOwinContext().Authentication.User;
  
              ....
              return Ok();
          }
      }
  }
  </code></pre>
  
  <p>The request is a <code>POST</code> and has the header:</p>
  
  <pre><code>Authorization: Bearer XXXXXXXTOKEHEREXXXXXXX
  </code></pre>
  
  <p>I get: <code>Authorization has been denied for this request.</code> returned in JSON.</p>
  
  <p>I tried doing a GET as well and I get what I would expect, that the method isn't supported since I didn't implement it.</p>
  
  <p>Here is my Authorization Provider:</p>
  
  <pre><code>public class SimpleAuthorizationServerProvider : OAuthAuthorizationServerProvider
  {
      public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
          context.Validated();
      }
  
      public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
  
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
  
          using (var repo = new AuthRepository())
          {
              IdentityUser user = await repo.FindUser(context.UserName, context.Password);
  
              if (user == null)
              {
                  context.SetError("invalid_grant", "The user name or password is incorrect.");
                  return;
              }
          }
  
          var identity = new ClaimsIdentity(context.Options.AuthenticationType);
          identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
          identity.AddClaim(new Claim(ClaimTypes.Role, "User"));
  
          context.Validated(identity); 
  
      }
  }
  </code></pre>
  
  <p>Any help would be great. I'm not sure if it is the request or the code that is wrong. </p>
  
  <p>edit:
  Here is my <code>Startup.cs</code></p>
  
  <pre><code>public class Startup
  {
      public void Configuration(IAppBuilder app)
      {
          var config = new HttpConfiguration();
          WebApiConfig.Register(config);
          app.UseWebApi(config);
          ConfigureOAuth(app);
      }
  
      public void ConfigureOAuth(IAppBuilder app)
      {
          var oAuthServerOptions = new OAuthAuthorizationServerOptions()
          {
              AllowInsecureHttp = true,
              TokenEndpointPath = new PathString("/token"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
              Provider = new SimpleAuthorizationServerProvider()
          };
  
          // Token Generation
          app.UseOAuthAuthorizationServer(oAuthServerOptions);
          app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
  
      }
  }
  </code></pre>