title: OpenIddict migration from v2 to v3 rc1 - Login success, Authorize Failed
body: <p>I have tried to migration my project from v2 to v3 and I think i have updated everything, but for some reason i can login fine and i get an access_token returned, but this access_token fails to authorize a request.  Not sure why, but if someone can see anything obvious that would be great.  My application is a web Api with a angular2 web application for the client.</p>
  <p>In v2 i was using JWT, but i understand that this is the default in v3 so i may have some code that needs to removed for this to work.</p>
  <p>To restrict a controllers methods or a single method, i am using <code>[Authorize]</code> attribute.</p>
  <p>Extension method to be called in Startup.cs for adding Authentication, done to keep Startup.cs file from getting to big and keeps things in one place</p>
  <pre><code>/// &lt;summary&gt;
  /// Add authentication
  /// &lt;/summary&gt;
  /// &lt;param name=&quot;services&quot;&gt;&lt;/param&gt;
  /// &lt;param name=&quot;appSettings&quot;&gt;&lt;/param&gt;
  public static void AddAuthentication(this IServiceCollection services, AppSettings appSettings)
  {
      // appSettings.ApiUrl = &quot;http://localhost:5000&quot;
      // appSettings.WebsiteUrl = &quot;http://localhost:4200&quot;
  
      // the default value for AllowuserNameCharacters is &quot;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+&quot;
      // here we have just added some additional characters
      services.AddIdentity&lt;User, Role&gt;(options =&gt; { options.User.AllowedUserNameCharacters += &quot;'&amp;&quot;; })
          .AddDefaultTokenProviders();
  
      // Configure Identity to use the same JWT claims as OpenIddict instead
      // of the legacy WS-Federation claims it uses by default (ClaimTypes),
      // which saves you from doing the mapping in your authorization controller.
      services.Configure&lt;IdentityOptions&gt;(options =&gt;
      {
          options.ClaimsIdentity.UserNameClaimType = Claims.Name;
          options.ClaimsIdentity.UserIdClaimType = Claims.Subject;
          options.ClaimsIdentity.RoleClaimType = Claims.Role;
      });
  
      // return unauthorized message instead of url
      services.ConfigureApplicationCookie(options =&gt;
      {
          options.Events.OnRedirectToLogin = context =&gt;
          {
              context.Response.StatusCode = 401;
              return System.Threading.Tasks.Task.CompletedTask;
          };
      });
  
      // configure all tokens generated from aspnet to expire in 3 days (create password, forget password etc)
      services.Configure&lt;DataProtectionTokenProviderOptions&gt;(options =&gt; options.TokenLifespan = TimeSpan.FromDays(3));
  
      // Authentication
      var authenticationBuilder = services.AddAuthentication(options =&gt;
      {
          options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
          options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
      })
          .AddJwtBearer(cfg =&gt;
          {
              cfg.Authority = appSettings.ApiUrl;
              cfg.Audience = appSettings.ApiUrl;
              cfg.RequireHttpsMetadata = false;
              cfg.SaveToken = true;
          });
  
      // OpenIddict
      services.AddOpenIddict()
          .AddCore(options =&gt;
          {
              options.UseEntityFramework(e =&gt; e.UseDbContext&lt;ApplicationDbContext&gt;());
          })
          .AddServer(options =&gt;
          {
              // For token lifetimes look at the below link
              // https://github.com/openiddict/openiddict-core/wiki/Configuration-and-options
  
              // Enable the authorization, logout, token endpoints.
              options.SetAuthorizationEndpointUris(&quot;/connect/authorize&quot;)
                     .SetLogoutEndpointUris(&quot;/connect/logout&quot;)
                     .SetTokenEndpointUris(&quot;/connect/token&quot;);
  
              // Note: the Mvc.Client sample only uses the code flow and the password flow, but you
              // can enable the other flows if you need to support implicit or client credentials.
              options.AllowPasswordFlow()
                     .AllowRefreshTokenFlow();
  
              // Mark the &quot;email&quot;, &quot;profile&quot; and &quot;roles&quot; scopes as supported scopes.
              options.RegisterScopes(Scopes.Email,
                                     Scopes.Profile,
                                     Scopes.OpenId,
                                     Scopes.OfflineAccess,
                                     Scopes.Roles);
  
              // code to allow requests without client_id
              options.AcceptAnonymousClients();
  
              options.AddDevelopmentEncryptionCertificate()
                     .AddDevelopmentSigningCertificate();
  
              // Register the ASP.NET Core MVC binder used by OpenIddict.
              // Note: if you don't call this method, you won't be able to
              // bind OpenIdConnectRequest or OpenIdConnectResponse parameters.
              options.UseAspNetCore()
                     .EnableAuthorizationEndpointPassthrough()
                     .EnableLogoutEndpointPassthrough()
                     .EnableTokenEndpointPassthrough()
                     .DisableTransportSecurityRequirement();  // Never use https because we use load balancer
          })
          .AddValidation(options =&gt;
          {
              // Import the configuration from the local OpenIddict server instance.
              options.UseLocalServer();
  
              // Register the ASP.NET Core host.
              options.UseAspNetCore();
          });
  }
  </code></pre>
  <p>Startup.cs</p>
  <pre><code>/// &lt;summary&gt;
  /// Configure services
  /// &lt;/summary&gt;
  /// &lt;param name=&quot;services&quot;&gt;&lt;/param&gt;
  public void ConfigureServices(IServiceCollection services)
  {
      // application settings
      var appSettings = new AppSettings();
      Configuration.Bind(appSettings);
  
      // mvc
      services.AddMvc(appSettings);
  
      // identity / saml etc
      services.AddAuthentication(appSettings);
  }
  
  /// &lt;summary&gt;
  /// Configure application
  /// &lt;/summary&gt;
  /// &lt;param name=&quot;applicationBuilder&quot;&gt;&lt;/param&gt;
  /// &lt;param name=&quot;webHostEnvironment&quot;&gt;&lt;/param&gt;
  /// &lt;param name=&quot;loggerFactory&quot;&gt;&lt;/param&gt;
  public void Configure(IApplicationBuilder applicationBuilder, IWebHostEnvironment webHostEnvironment, ILoggerFactory loggerFactory)
  {
      // get current appSettings and output to logger
      var appSettings = applicationBuilder.ApplicationServices.GetRequiredService&lt;AppSettings&gt;();
      var logger = loggerFactory.CreateLogger(appSettings.ApiUrl);
      logger.LogInformation(string.Format(&quot;{0}\n{1}&quot;, appSettings.Environment, appSettings.Data.DefaultConnection.ConnectionString));
  
      // environment
      webHostEnvironment.EnvironmentName = appSettings.Environment;
  
      // CORS
      applicationBuilder.UseCors(&quot;Default&quot;);
  
      // static files in root
      applicationBuilder.UseStaticFiles();
  
      // routing
      applicationBuilder.UseRouting();
  
      // comment this out and you get an error saying 
      // InvalidOperationException: No authentication handler is configured to handle the scheme: Microsoft.AspNet.Identity.External
      applicationBuilder.UseAuthentication();
  
      // for authorization headers
      applicationBuilder.UseAuthorization();
  
      // response caching
      applicationBuilder.UseResponseCaching();
  
      // routes
      applicationBuilder.UseEndpoints(options =&gt;
      {
          // default goes to Home, and angular will deal with client side routing     
          options.MapControllerRoute(
              name: &quot;default&quot;,
              pattern: &quot;{*url}&quot;,
              defaults: new { controller = &quot;home&quot;, action = &quot;index&quot; });
      });
  }
  </code></pre>
  <p>I have updated my AuthorizationController.cs as well</p>
  <pre><code>/// &lt;summary&gt;
  /// Handles authorization requests
  /// &lt;/summary&gt;
  [ApiExplorerSettings(IgnoreApi = true)]
  public class AuthorizationController : Controller
  {
      private IOptions&lt;IdentityOptions&gt; _identityOptions;
      private OpenIddictApplicationManager&lt;OpenIddictEntityFrameworkApplication&gt; _applicationManager;
      private SignInManager&lt;MyUser&gt; _signInManager;
      private UserManager&lt;MyUser&gt; _userManager;
      private AppSettings _appSettings;
      private IEncryptionService _encryptionService;
  
      /// &lt;summary&gt;
      /// Create a new authorization controller
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;identityOptions&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;applicationManager&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;signInManager&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;userManager&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;appSettings&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;encryptionService&quot;&gt;&lt;/param&gt;
      public AuthorizationController(
          IOptions&lt;IdentityOptions&gt; identityOptions,
          OpenIddictApplicationManager&lt;OpenIddictEntityFrameworkApplication&gt; applicationManager,
          SignInManager&lt;MyUser&gt; signInManager, UserManager&lt;MyUser&gt; userManager,
          AppSettings appSettings, IEncryptionService encryptionService)
      {
          _identityOptions = identityOptions;
          _applicationManager = applicationManager;
          _signInManager = signInManager;
          _userManager = userManager;
          _appSettings = appSettings;
          _encryptionService = encryptionService;
      }
  
      // Note: to support interactive flows like the code flow,
      // you must provide your own authorization endpoint action:
  
      /// &lt;summary&gt;
      /// Authorize an openId request
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;connectRequest&quot;&gt;&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      [Authorize, HttpGet, Route(&quot;~/connect/authorize&quot;)]
      public async Task&lt;IActionResult&gt; Authorize()
      {
          var request = HttpContext.GetOpenIddictServerRequest() ??
              throw new InvalidOperationException(&quot;The OpenID Connect request cannot be retrieved.&quot;);
  
          // Retrieve the application details from the database.
          var application = await _applicationManager.FindByClientIdAsync(request.ClientId, new System.Threading.CancellationToken());
  
          if (application == null)
          {
              return Forbid(
                  authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                  properties: new AuthenticationProperties(
                      new Dictionary&lt;string, string&gt;
                      {
                          [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidClient,
                          [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;Details concerning the calling client application cannot be found in the database&quot;
                      }
                  )
              );
          }
  
          // Flow the request_id to allow OpenIddict to restore
          // the original authorization request from the cache.
          return View(new AuthorizeViewModel
          {
              ApplicationName = application.DisplayName,
              RequestId = request.RequestId,
              Scope = request.Scope
          });
      }
  
      /// &lt;summary&gt;
      /// Accept an openId request
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;request&quot;&gt;&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      [Authorize, HttpPost(&quot;~/connect/authorize/accept&quot;), ValidateAntiForgeryToken]
      public async Task&lt;IActionResult&gt; Accept()
      {
          var request = HttpContext.GetOpenIddictServerRequest() ??
              throw new InvalidOperationException(&quot;The OpenID Connect request cannot be retrieved.&quot;);
  
          // Retrieve the profile of the logged in user
          var user = await _userManager.GetUserAsync(User);
  
          if (user == null)
          {
              return Forbid(
                  authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                  properties: new AuthenticationProperties(
                      new Dictionary&lt;string, string&gt;
                      {
                          [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.ServerError,
                          [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;An internal error has occurred&quot;
                      }
                  )
              );
          }
  
          // create a new principal
          var principal = await CreatePrincipalAsync(request, user);
  
          // returning a SignInResult will ask OpenIddict to issue the appropriate access/identity tokens.
          return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
      }
  
      /// &lt;summary&gt;
      /// Deny an openId request
      /// &lt;/summary&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      [Authorize, HttpPost(&quot;~/connect/authorize/deny&quot;), ValidateAntiForgeryToken]
      public IActionResult Deny()
      {
          // Notify OpenIddict that the authorization grant has been denied by the resource owner
          // to redirect the user agent to the client application using the appropriate response_mode.
          return Forbid(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
      }
  
      /// &lt;summary&gt;
      /// Logout
      /// &lt;/summary&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      [HttpPost(&quot;~/connect/logout&quot;)]
      public async Task&lt;IActionResult&gt; Logout()
      {
          // Ask ASP.NET Core Identity to delete the local and external cookies created
          // when the user agent is redirected from the external identity provider
          // after a successful authentication flow (e.g Google or Facebook).
          await _signInManager.SignOutAsync();
  
          // Returning a SignOutResult will ask OpenIddict to redirect the user agent
          // to the post_logout_redirect_uri specified by the client application.
          return SignOut(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
      }
  
      // Note: to support non-interactive flows like password,
      // you must provide your own token endpoint action:
  
      /// &lt;summary&gt;
      /// Exchange request for valid openId token
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;request&quot;&gt;&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      [HttpPost(&quot;~/connect/token&quot;)]
      [Produces(&quot;application/json&quot;)]
      public async Task&lt;IActionResult&gt; Exchange()
      {
          var request = HttpContext.GetOpenIddictServerRequest() ??
              throw new InvalidOperationException(&quot;The OpenID Connect request cannot be retrieved.&quot;);
  
          if (request.IsPasswordGrantType())
          {
              var user = await _userManager.FindByNameAsync(request.Username);
  
              if (user == null)
              {
                  return Forbid(
                      authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                      properties: new AuthenticationProperties(
                          new Dictionary&lt;string, string&gt;
                          {
                              [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                              [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;The username/password couple is invalid&quot;
                          }
                      )
                  );
              }
  
              // Ensure the password is valid.
              if (!await _userManager.CheckPasswordAsync(user, request.Password))
              {
                  if (_userManager.SupportsUserLockout)
                  {
                      await _userManager.AccessFailedAsync(user);
                  }
  
                  return Forbid(
                      authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                      properties: new AuthenticationProperties(
                          new Dictionary&lt;string, string&gt;
                          {
                              [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                              [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;The username/password couple is invalid&quot;
                          }
                      )
                  );
              }
  
              if (_userManager.SupportsUserLockout)
              {
                  await _userManager.ResetAccessFailedCountAsync(user);
              }
  
              // create a new principal
              var principal = await CreatePrincipalAsync(request, user);
  
              return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
          }
          else if (request.IsRefreshTokenGrantType())
          {
              // Retrieve the claims principal stored in the authorization code/refresh token.
              var info = await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
  
              // Retrieve the user profile corresponding to the refresh token
              var user = await _userManager.GetUserAsync(info.Principal);
  
              if (user == null)
              {
                  return Forbid(
                      authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                      properties: new AuthenticationProperties(
                          new Dictionary&lt;string, string&gt;
                          {
                              [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                              [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;The refresh token is no longer valid&quot;
                          }
                      )
                  );
              }
  
              // Ensure the user is still allowed to sign in
              if (!await _signInManager.CanSignInAsync(user))
              {
                  return Forbid(
                      authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                      properties: new AuthenticationProperties(
                          new Dictionary&lt;string, string&gt;
                          {
                              [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                              [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = &quot;The user is no longer allowed to sign in&quot;
                          }
                      )
                  );
              }
  
              // create a new principal
              var principal = await CreatePrincipalAsync(request, user);
  
              return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
          }
  
          throw new NotImplementedException(&quot;The specified grant type is not implemented&quot;);
      }
  
      /// &lt;summary&gt;
      /// Creates a principal based on the openId request
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;request&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;user&quot;&gt;&lt;/param&gt;
      /// &lt;param name=&quot;properties&quot;&gt;&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      private async Task&lt;ClaimsPrincipal&gt; CreatePrincipalAsync(OpenIddictRequest request, MyUser user, AuthenticationProperties properties = null)
      {
          // Create a new ClaimsPrincipal containing the claims that
          // will be used to create an id_token, a token or a code.
          var principal = await _signInManager.CreateUserPrincipalAsync(user);
  
          if (!request.IsRefreshTokenGrantType())
          {
              // Set the list of scopes granted to the client application.
              // Note: the offline_access scope must be granted
              // to allow OpenIddict to return a refresh token.
              principal.SetScopes(new[]
              {
              Scopes.OpenId,
              Scopes.Email,
              Scopes.Profile,
              Scopes.OfflineAccess,
              Scopes.Roles
              }.Intersect(request.GetScopes()));
          }
  
          // Set resource
          principal.SetResources(new string[] { _appSettings.ApiUrl });
  
          // Note: by default, claims are NOT automatically included in the access and identity tokens.
          // To allow OpenIddict to serialize them, you must attach them a destination, that specifies
          // whether they should be included in access tokens, in identity tokens or in both.
          foreach (var claim in principal.Claims)
          {
              claim.SetDestinations(GetDestinations(claim, principal));
          }
  
          return principal;
      }
  
      private IEnumerable&lt;string&gt; GetDestinations(Claim claim, ClaimsPrincipal principal)
      {
          // Note: by default, claims are NOT automatically included in the access and identity tokens.
          // To allow OpenIddict to serialize them, you must attach them a destination, that specifies
          // whether they should be included in access tokens, in identity tokens or in both.
  
          switch (claim.Type)
          {
              case Claims.Name:
                  yield return Destinations.AccessToken;
  
                  if (principal.HasScope(Scopes.Profile))
                      yield return Destinations.IdentityToken;
  
                  yield break;
  
              case Claims.Email:
                  yield return Destinations.AccessToken;
  
                  if (principal.HasScope(Scopes.Email))
                      yield return Destinations.IdentityToken;
  
                  yield break;
  
              case Claims.Role:
                  yield return Destinations.AccessToken;
  
                  if (principal.HasScope(Scopes.Roles))
                      yield return Destinations.IdentityToken;
  
                  yield break;
  
              // Never include the security stamp in the access and identity tokens, as it's a secret value.
              case &quot;AspNet.Identity.SecurityStamp&quot;: yield break;
  
              default:
                  yield return Destinations.AccessToken;
                  yield break;
          }
      }
  }
  </code></pre>
  <p>Also here is my applicationDbContext</p>
  <pre><code>/// &lt;summary&gt;
  /// Application context to hold our openIddict entities
  /// &lt;/summary&gt;
  public class ApplicationDbContext : DbContext, IApplicationDbContext
  {
      /// &lt;summary&gt;
      /// Create context with connection string
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;connectionString&quot;&gt;&lt;/param&gt;
      public ApplicationDbContext(string connectionString) : base(connectionString)
      {
          
      }
  
      /// &lt;summary&gt;
      /// When creating models
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;modelBuilder&quot;&gt;&lt;/param&gt;
      protected override void OnModelCreating(DbModelBuilder modelBuilder)
      {
          base.OnModelCreating(modelBuilder);
  
          modelBuilder.UseOpenIddict();
      }
  
      /// &lt;summary&gt;
      /// Authorizations
      /// &lt;/summary&gt;
      public virtual DbSet&lt;OpenIddictEntityFrameworkAuthorization&gt; Authorization { get; set; }
  
      /// &lt;summary&gt;
      /// Applications
      /// &lt;/summary&gt;
      public virtual DbSet&lt;OpenIddictEntityFrameworkApplication&gt; Application { get; set; }
  
      /// &lt;summary&gt;
      /// Tokens
      /// &lt;/summary&gt;
      public virtual DbSet&lt;OpenIddictEntityFrameworkToken&gt; Token { get; set; }
  
      /// &lt;summary&gt;
      /// Scopes
      /// &lt;/summary&gt;
      public virtual DbSet&lt;OpenIddictEntityFrameworkScope&gt; Scope { get; set; }
  }
  
  
  </code></pre>
  <p>As i said, i am getting a token returned, like below</p>
  <pre><code>{
    &quot;access_token&quot;: &quot;eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOiI5NDVDNjFERjcyRUU1OUNDNUNFQzQ0NzJCRDE0MDg4NDEyNTAyRjM3IiwidHlwIjoiYXQrand0In0.TxmA-Lv60Lwvr5eXdu2fgG95Bx4AUoPvp5XniqSYbBgmpDrVXCUpSjnEv7tWQ5QLPjks6TAy8hGAGfgQPFB1xDM05mZyu2WDPBsoEQ2VtxuabaPhj-uK2KjnWEccjS-n-YAY7OlSDFXrmiDsFCOf3jaPGZ43gUCPyTVl_WVE_KBGVXa19RDZFf9Ger-TsHY3evYbsUchOKMco-CD2IGt6Xg6DttxFcKF3SUPwMXhn6AGdkNesGVIoVSeDd_CnM3MyHtJIbGbkRkmwpMWsbwaWGI38itUJ0XeUqn45B_GsZfaZllytuMHbuqt1GgL0gdOaCfBUxaqy7AaYsY9UKlaEw.LS4FnIOCRESdeo1c5K2_5Q.Ic8fssDScEu7lAomL8d_7JZMVho5hLphg269UIETZui7DUB2gund7YCtGq7imdnDtN-wsEoZaLHJ4UQSJrpuIMCN2pW69J9kKcx-UT1e2Ma-JNj2G5CtxwRf_bszRRsgWC1ia85LU5TPsUFvhd_wDxyUax2GKowb0FVl8EFRoFdZF40h06LaofxDzD2BFdwSYaHaDm3icVNZ0CRpYCoZq-MK_c3Fl98l57zjZl1CNscs1w0trApMDvQ7UeFcez3zelN24H6TCaXqTRP3lixMiv9Rtm3Kqkv67HEUAFD-vXIMyWQTo28oJMMAQz9zQeTp88JsfI4Pv7euUECEkwK7Fe5rbxhD4oicNNa_wmRo2vsjrpm4C7mmRKH2u3cX2CCTwahOsVHxu4kO3zliWmniW-krEAAsaW6BjoWqJiGN3ydoiHLIv3muM78jt85KzKxMIFsalpdf2F9Z8neQBglhzxZQFp9JiEecczxao6Y03WuFNX98kZh8Zr4D21CM_m634u3mf5-Gz-frVlSgnMrE9vgCG2eETI3fOnObf9pQ1XWpK7I9SE0AZvc2PciaKO4H7mKDqXuXFrzdiz6Tx9G9MMkXXbuKsuslZJ6q9wlE3xOl9mzd6shN9GvfSTQNrFoV-PS62xhnfCFKQDfYLzWF1fhQbq_RECp6IVJN960jaMAGIZ0yzIbRInIkbhdFEIbl__h9AYo6FfcZgYv4tfw-iB_unezgHCIPpbBPC0eRMiZh1wqpfwpiJ8zjvcXJXXCfSlu13KlBWD9tHVEHh6aHE258hGdFzApA-MTCkjHwMRjVgmv_-Ed-xwk0hjBpRhiZv-0kNwKI72YJVgZMX9CMpFBg2CO5z5hHSlc0pO9pc5ovuCZ_dYYRiqqcIDUJ5Wl6dDt1JCPI084C4yssC7MC4e94OtvfRtrI096qMI34qrLWi-jn7UOMnWMUunNepQLwQ07DK-ubXsS-m0xvSxPYxtE6XM6QebmvCcXj__vELGscDu8mWmvP1Y0L9SoSpWlErHvlCPpkfVeMnkdP74cKTYgpXSQcGduqcdfU86leI9oUYgnrcPwvMgUq3jwgHGWn_0d4Bo8CsChWatYWmSNKN88h3WfASSl6SyqeVbSSYvIp-0HBGxGOwODgO-YsOlOgeKmm8oSIhnELVNMVEY1uiUZpJ9DGfrUUXKMw7aIz6LK_zH_HxlMiBam0fxgAQwRyYlO0AFmuxFO62KEHFEjdDSEO9pcUP03_RNqDfAX-IAV_EoFT7CwVpOZMUvFLo78S4xkq2ss3CFbkA3J4ioud88T5SUfslnsZmY1dJYtW4HhlGF7SKVMN6GSwckz1YhyaxqlQpMbMRFA0uCbkM6u41K0-_toRQejKDX5juqFwqK8.m0bmPYOuAYYdc6WfjDWP2UneysP1G3FqwlmOzWOrTnM&quot;,
    &quot;token_type&quot;: &quot;Bearer&quot;,
    &quot;expires_in&quot;: 3599,
    &quot;id_token&quot;: &quot;eyJhbGciOiJSUzI1NiIsImtpZCI6IjcwMzJBRUJBQjc4NkNCM0ExRkI3Nzk1NjdDQTRGRjU1ODg3OTFCNDEiLCJ4NXQiOiJjREt1dXJlR3l6b2Z0M2xXZktUX1ZZaDVHMEUiLCJ0eXAiOiJKV1QifQ.eyJzdWIiOiIxIiwibmFtZSI6InBvd2VydXNlckBtZWFzdXJlMmltcHJvdmUuY29tIiwib2lfYXVfaWQiOiIxMDJjZTE0NC02NzkyLTRlYzAtOTlhNy0xZDBlMzdmNzkyZTYiLCJhdF9oYXNoIjoiV3BibExxNFdNR2dwdHdGVVVSMktRdyIsIm9pX3Rrbl9pZCI6IjQyMzBlYmJkLWUyNzItNDJlZS1iOTZiLTQ1ZGJmMTJlZWJmMiIsImV4cCI6MTYwNjQ3NzgzOSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwLyIsImlhdCI6MTYwNjQ3NjYzOX0.WZkB63ZfZuJfigNVabPegu-B8TvMeS1DmgRQJS151XGR08Pw-fcCldb35oM7ZW9oQenj7059BAZMI1EveHWNVWOEFpabebi7TccGRoR1YKqWSNWTBDwyQgGMyehVmze_TPgsSjAJA0y1f_xtF3-ImfVx5Tzlcjg4XAmAhV3MRd-fEobdGk5540uto5hZJ7ieHrV_7U_FF4NgVT5nSw92bkFNjUokmNgMBpDWelZUEXmsb3MFGDMnQkP0oTGXeIcy0nuuIKpr1Liza_cvv1JfICQnSUKw_u3zdqSbsbXtzGg9GfunEhXf1zSF5dxfbNpr2E4bsnIxGJ-mOYxBsOQDJA&quot;,
    &quot;refresh_token&quot;: &quot;eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOiI5NDVDNjFERjcyRUU1OUNDNUNFQzQ0NzJCRDE0MDg4NDEyNTAyRjM3IiwidHlwIjoib2lfcmVmdCtqd3QifQ.E5xUDcqMK15spCgqoM8YrOCn_32wBX_X_XsG_f1nKOR-TcDI2AKi07vX62uMmbO1bgclGSGNynEUTuPt7KATf9UHXwpytXAK3_BnLxQLz7NbYIlfrja9t5z3gCRIGOZ-5gHbHcU6RdJrDpC73_V7CXYIfkVhfWeeS30_3GtLa-BUu4Nlr9YL7K22KdR0LJQsK6SXLMKobsj6PLrrywHnClaw6dG_O_SDezC5M_eIo_ErdHFqUBwWYhUHyntijJ9ekH4A2SiY0LGaQD6QyvmUNPC7E-LtLVO78saJYAgGW-CkQbwTBF7b_vOoEr_mPrFnpytwLnIvxSQCFVjclH-vzA.RGNxh09nh1RWb6XU6jNZSg.VRwdO_5UrB7tqaMHXwt6qZN8VucSlNXnBNoBxcvisDvjWhBOlhrJxEidGQPBeiIpbrYrWQXyPfSgFrmZAlqYcF-3cXTl0W-xR4oW1ZqRf95eMs-YTA9-bR6n8P2pV7WeYky7wkwa-i3Vs9rzasYjK18LTU6v71xMNVN2K0Z2HRgTXxPg3U4HUgkVQpZp4qetyhozdOhGBV37igAHSZHFUSYg-dlstz3DtEX7IXvi7GQbM_fLKVlDLWYZOtX1yH366C9TIjZbxGP3h-qPqfKKDNP-IhD_x2IpymmiKllfhfLKb62JQzy_ci-ICXGvs0z_ZLZirmzVSEotqrcKmwe1rlqRXbymP8llIXe3AzjLonN3I_35bLeqZz1KQE93pkLOpJGAJuhJ4dc8a7wJ5kxTAs9_CCvb6UBvhRxInUyZ9PQq026RaYJvN9i--x8JxAAtH58h9Y5zgm_M4kFbEoGgZshyGZ8QSQrp4JpPrGeW9ElvkyEmrGvEpm6zmy_Y6tEF3lXFfrGJL6FPGD5_q8m9lGQ162OCmZMGg2Sy46Hne0SPv04TpM43F-m82BTzXxGRbpvOoNye7Pl9dKbdOBno1WEmaesL-R-W_8qogNszW5c-gbhQTUjcQ1J5yuVL4r29qN9xhVDPKqxPYPzInCr30m8SH41NI6WusFVJbNoqVs43wymGfQwuDfJacVCIfuT1Lx2VMdVl3nvCAGOnEwiUDufjqMaA-Nh-Row4QIwTHMGwfzxbFkQjRfwq_NjVU0LZlVDX2BgSETw2ak3KpgAGoeDlVVwmXuQpbvZ3wRHVh4a3k3_JVGf1dOiHbXVcWx984-EARKmW6gLjIhe2t5tzIJ9NQqBrdBrCvMmQXWfBiP00-YH31yDfYRF9tNZoojnkcrkOewHFUsEcFuayBzP5ySR6RgGVVE_zkEXTnBXxeiynzfJn0D3XthpRPosLJTJz91tdmvo6CxPWuaaZoUlXq_EXqFrGCb09f11Hs_mKu7T7pHMbJioTAvj1Jy8jzduMU3Rth-w0A8Md2gdeKmoCXW51lvpuyFsP4R8AdthhXGUbAk6rNJXdkaUkRyygYU8ZQWI2WCyroDnBRpEIaBtjYT1Uf4zXyTUZ3jicKe5Rjr08tmgAQd_3pNu1Wb2dBQgvcoqnwXcnLvoMTp0yk7Osae94Pqh_Oyz45kz_oS_7fR6WvZm-avBPYLmW92eQWiMG6glxPPe_Vnq9ghwjYjS4KEvyFaDqusDWmxBEDwEzLgBTF3p0R2saedTbwpG4Epcey_T18KEuklAWbCwz-fvV3ip-_wGUNe6cuAOeyuXcUHm18Le0knZt6xNS_a8cxMz9RAEpBs3a-tOWQLrVELXxnNY03NL2szkNQuDUzY9JRtTxqngxcPpHVk058dRG1rwFZqiI4-6_yL03X_fbXsIR0ItBig9surYyB_crwyH3C6OZTnGgwxLKUU9qY0LNTzR0gatrrT1l8NrorLAvODzQqhrqqClHgZkVoQXANvz3mNZWIpxjCkOgDkH-YOaaR3egnwLVMk_clo3-gC76UQ-5T-NnZ7MJTv2twFBhUKHABEJsT9a3nR7ra2CbHFzJFNvRRCPHAGOVAY-y-Ek0xZn8mvd3Fvw4wlej4EdQvlnFUcaIH4Cl0MZD9G9t2W3A96KLRZctVfGK6W1yM846DWHwSfeTj3ZPN_6bYDqbWHoXrQxe5BGi9aN8PXfL1Bu9W5jhQpgrvTRvnjhYqwN24ta9r6BbrMzBL3cszf56dG3Ko6aA8gDwUmDSjyNVhk76sdoW.1xLMuQf7NjeYjAXDL5BUxaoFSR0EECEzPh7XxkE8Hj4&quot;
  }
  </code></pre>
  <p>Here is the token being passed successfully, but Unauthorized is returned, as you can see the next call fails as well.
  <a href="https://i.stack.imgur.com/wEKyL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wEKyL.png" alt="enter image description here" /></a></p>
  <p>Any help much appreciated</p>