title: Identity Server 4 Cant Validate My Access Token
body: <p>I am using Asp.net Core 3.1 Web Api For Generate Api And Use Identity Server 4(3.1.2) With asp.net identity core In Same Project(Both In One Project) To Authenticate User.
  Identity Server 4 Generate Access Token But When Call Api With Postman,EveryTime Return 401.
  This is my Identity Server 4 Config:</p>
  <pre><code> &quot;IdentityServerSetting&quot;: {
      &quot;IdentityServerAuthority&quot;: &quot;https://localhost:5000&quot;,
      &quot;IdentityResources&quot;: [
        &quot;openID&quot;
      ],
      &quot;ApiResources&quot;: [
        {
          &quot;Name&quot;: &quot;MadPay&quot;,
          &quot;DisplayName&quot;: &quot;MadPay Api&quot;,
          &quot;UserClaims&quot;: [
            &quot;name&quot;,
            &quot;Email&quot;
          ]
        }
      ],
      &quot;Client&quot;: [
        {
          &quot;AccessTokenLifeTime&quot;: 3600,
          &quot;AllowedGrantTypes&quot;: &quot;password&quot;,
          &quot;ClientId&quot;: &quot;angular&quot;,
          &quot;AlwaysIncludeUserClaimsInIdToken&quot;: &quot;true&quot;,
          &quot;AlwaysSendClientClaims&quot;: &quot;true&quot;,
          &quot;AllowCorsOrigins&quot;: [ &quot;https://localhost:5000&quot; ],
          &quot;RequireClientSecret&quot;: &quot;false&quot;,
          &quot;AllowedScopes&quot;: [ &quot;OpenId&quot;, &quot;MadPay&quot; ],
          &quot;AllowOfflineAccess&quot;: &quot;true&quot;
        }
      ]
    }
  </code></pre>
  <p>This Is My ConfigureService</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              services.Configure&lt;JwtConfig&gt;(_configuration.GetSection(nameof(JwtConfig)));
              services.Configure&lt;IdentityServerSetting&gt;(_configuration.GetSection(nameof(IdentityServerSetting)));
  
              services.AddScoped&lt;IUnitOfWork, UnitOfWork&lt;ApplicationDBContext&gt;&gt;();
  
              services.AddMapperConfigurations();
              services.AddServices();
  
              services.AddDbContext&lt;ApplicationDBContext&gt;(opt =&gt;
              {
                  opt.UseSqlServer(_configuration.GetConnectionString(&quot;ApplicationConnection&quot;));
              });
  
              services.AddMvcCore(opt =&gt; opt.EnableEndpointRouting = false)
               .SetCompatibilityVersion(CompatibilityVersion.Version_3_0)
               .AddAuthorization()
               .AddNewtonsoftJson(options =&gt;
                      options.SerializerSettings.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore);
  
              services.AddResponseCaching();
              services.AddIdentityServerConfig(_identityServerSetting);
              services.AddApiAuthorization();
  
              services.AddCors();
              services.AddSingleton&lt;IHttpContextAccessor, HttpContextAccessor&gt;();
              services.Configure&lt;ApiBehaviorOptions&gt;(options =&gt;
              {
                  options.SuppressModelStateInvalidFilter = true;
              });
          }
  </code></pre>
  <p>This Is My Configure</p>
  <pre><code> public void Configure(IApplicationBuilder app, IHostEnvironment env)
          {
              IdentityModelEventSource.ShowPII = true;
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                  app.UseHsts();
              }
  
              //app.UseHsts();
  
              app.UseCors(i =&gt; i.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
              app.AddExceptionHandling();
              app.UseResponseCaching();
              app.UseIdentityServer();
              app.UseHttpContext();
              app.UseHttpsRedirection();
              app.UseStaticFiles();
  
              app.UseMvc(routes =&gt;
              {
                  routes.MapRoute(
                      name: &quot;default&quot;,
                      template: &quot;api/{controller}/{action}/{id?}&quot;);
              });
          }
  </code></pre>
  <p>AddApiAuthorization Fuction</p>
  <pre><code> public static void AddApiAuthorization(this IServiceCollection services)
          {
              services.AddAuthentication(options =&gt;
              {
                  options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              })
                  .AddJwtBearer(opt =&gt;
                   {
                       opt.Authority = &quot;https://localhost:5000&quot;;
                       opt.RequireHttpsMetadata = false;
                       //opt.Audience = &quot;MadPay&quot;;
                       opt.TokenValidationParameters = new TokenValidationParameters
                       {
                           ValidateAudience = false
                       };
                   });
  
   services.AddScoped&lt;IAuthorizationHandler, PermissionAuthorizationHandler&gt;();
  
              services.AddAuthorization(option =&gt;
                  option.AddPolicy(&quot;Permission&quot;, builder =&gt;
                      builder.AddRequirements(new PermissionRequirement()).RequireAuthenticatedUser()
                  )
              );
  }
  </code></pre>
  <p>AddIdentityServerConfig Fuction</p>
  <pre><code> public static void AddIdentityServerConfig(this IServiceCollection services, IdentityServerSetting config)
          {
              var finalConfig = MapJsonToConfig(config);
  
              services.AddIdentity&lt;User, Role&gt;(opt =&gt;
              {
                  opt.Password.RequireLowercase = false;
                  opt.Password.RequireUppercase = false;
                  opt.Password.RequireNonAlphanumeric = false;
  
                  opt.User.RequireUniqueEmail = true;
  
                  opt.SignIn.RequireConfirmedAccount = true;
                  opt.SignIn.RequireConfirmedEmail = true;
              })
              .AddEntityFrameworkStores&lt;ApplicationDBContext&gt;()
              .AddUserManager&lt;AppUserManager&gt;()
              //.AddSignInManager&lt;AppSignInManager&gt;()
              .AddErrorDescriber&lt;AppErrorDescriberService&gt;()
              .AddDefaultTokenProviders();
  
              services.AddIdentityServer(options =&gt;
              {
                  options.Events.RaiseErrorEvents = true;
                  options.Events.RaiseInformationEvents = true;
                  options.Events.RaiseFailureEvents = true;
                  options.Events.RaiseSuccessEvents = true;
              })
  
                      .AddDeveloperSigningCredential()
                      .AddInMemoryIdentityResources(finalConfig.IdentityResources)
                      .AddInMemoryApiResources(finalConfig.Apis)
                      .AddInMemoryClients(finalConfig.Clients)
                      .AddAspNetIdentity&lt;User&gt;()
                      .AddResourceOwnerValidator&lt;AppIdentityPasswordValidator&lt;User&gt;&gt;();
          }
  </code></pre>
  <p>This is My Paload from access token</p>
  <pre><code>
  {
    &quot;nbf&quot;: 1597823415,
    &quot;exp&quot;: 1597827015,
    &quot;iss&quot;: &quot;https://localhost:5000&quot;,
    &quot;aud&quot;: &quot;MadPay&quot;,
    &quot;client_id&quot;: &quot;angular&quot;,
    &quot;sub&quot;: &quot;1&quot;,
    &quot;auth_time&quot;: 1597823413,
    &quot;idp&quot;: &quot;local&quot;,
    &quot;name&quot;: &quot;osali&quot;,
    &quot;scope&quot;: [
      &quot;MadPay&quot;,
      &quot;offline_access&quot;
    ],
    &quot;amr&quot;: [
      &quot;pwd&quot;
    ]
  }
  </code></pre>
  <p>And For Call Api Use This url : https://localhost:5000/...
  And Send Token in Authorization Header : Bearer ....</p>
  <p>i think Issued access token is not a problem.
  I spent a few days And Cant Understand Why is not working and very confused what is wrong!!</p>
  <p>Thank You</p>