title: Accessing protected API on IdentityServer4 with Bearer Token
body: <p>I have attempted to search for a solution to this problem, but have not found the right search text.</p>
  
  <p>My question is, how can I configure my IdentityServer so that it will also accept/authorize Api Requests with BearerTokens?</p>
  
  <p>I have an IdentityServer4 configured and running.
  I also have configured a Test API on my IdentityServer like below:</p>
  
  <pre><code>[Authorize]
  [HttpGet]
  public IActionResult Get()
  {
      return new JsonResult(from c in User.Claims select new { c.Type, c.Value });
  }
  </code></pre>
  
  <p>In my startup.cs ConfigureServices() is as follows:</p>
  
  <pre><code>public IServiceProvider ConfigureServices(IServiceCollection services)
      {
          ...
          // configure identity server with stores, keys, clients and scopes
          services.AddIdentityServer()
              .AddCertificateFromStore(Configuration.GetSection("AuthorizationSettings"), loggerFactory.CreateLogger("Startup.ConfigureServices.AddCertificateFromStore"))
  
              // this adds the config data from DB (clients, resources)
              .AddConfigurationStore(options =&gt;
              {
                  options.DefaultSchema = "auth";
                  options.ConfigureDbContext = builder =&gt;
                  {
                      builder.UseSqlServer(databaseSettings.MsSqlConnString,
                          sql =&gt; sql.MigrationsAssembly(migrationsAssembly));
                  };
              })
  
              // this adds the operational data from DB (codes, tokens, consents)
              .AddOperationalStore(options =&gt;
              {
                  options.DefaultSchema = "auth";
                  options.ConfigureDbContext = builder =&gt;
                      builder.UseSqlServer(databaseSettings.MsSqlConnString,
                          sql =&gt; sql.MigrationsAssembly(migrationsAssembly));
  
                  // this enables automatic token cleanup. this is optional.
                  options.EnableTokenCleanup = true;
                  options.TokenCleanupInterval = 30;
              })
  
              // this uses Asp Net Identity for user stores
              .AddAspNetIdentity&lt;ApplicationUser&gt;()
              .AddProfileService&lt;AppProfileService&gt;()
              ;
  
          services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
              .AddIdentityServerAuthentication(options =&gt;
                  {
                      options.Authority = authSettings.AuthorityUrl;
                      options.RequireHttpsMetadata = authSettings.RequireHttpsMetadata;
                      options.ApiName = authSettings.ResourceName;
                  })
  </code></pre>
  
  <p>and Configure() is as follows:</p>
  
  <pre><code>        // NOTE: 'UseAuthentication' is not needed, since 'UseIdentityServer' adds the authentication middleware
          // app.UseAuthentication();
          app.UseIdentityServer();
  </code></pre>
  
  <p>I have a client configured to allow Implicit grant types and have included the configured <strong>ApiName</strong> as one of the AllowedScopes:</p>
  
  <pre><code> new Client
              {
                  ClientId = "47DBAA4D-FADD-4FAD-AC76-B2267ECB7850",
                  ClientName = "MyTest.Web",
                  AllowedGrantTypes = GrantTypes.Implicit,
  
                  RequireConsent = false,
  
                  RedirectUris           = { "http://localhost:6200/assets/oidc-login-redirect.html", "http://localhost:6200/assets/silent-redirect.html" },
                  PostLogoutRedirectUris = { "http://localhost:6200/?postLogout=true" },
                  AllowedCorsOrigins     = { "http://localhost:6200" },
  
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      IdentityServerConstants.StandardScopes.Email,
                      "dev.api",
                      "dev.auth" // &lt;- ApiName for IdentityServer authorization
                  },
                  AllowAccessTokensViaBrowser = true,
                  AllowOfflineAccess = true,
                  AccessTokenLifetime = 18000,
              },
  </code></pre>
  
  <p>When I use Postman to access the protected API but it always redirects to the Login page even though a valid Bearer Token has been added to the Request header.</p>
  
  <p>Commenting out the [Authorize] attribute will correctly return a response, but of course the User.Claims are empty.</p>
  
  <p>When logging into the IdentityServer (via a browser) and then accessing the API (via the browser) it will also return a response.  This time, the User.Claims are available.</p>