title: Spring Security is not working with Authorization: Bearer token from OAuth2
body: <p>I have two microservices, the first for OAuth2 and the second for API. When I log in from the browser, everything works fine, authorization passes and redirection to my API works. But when I try to do it through Postman, I don’t get access to API.</p>
  
  <p>Please see this link, I've copied a lot of code from this <a href="https://www.baeldung.com/sso-spring-security-oauth2" rel="nofollow noreferrer">https://www.baeldung.com/sso-spring-security-oauth2</a></p>
  
  <p>Tech stack: Java 8, Spring Boot, Spring Web, Spring Security, OAuth2.</p>
  
  <p>I tried to use different configs and many options, but so far I have returned the code to the outgoing state so that you can tell me what could be the error.</p>
  
  <p>auth module:</p>
  
  <pre><code>server:
    port: 8081
    servlet:
      context-path: /auth
  </code></pre>
  
  <pre><code>@SpringBootApplication
  @EnableResourceServer
  public class AuthApplication extends SpringBootServletInitializer {
  
      public static void main(String[] args) {
          SpringApplication.run(AuthApplication.class, args);
      }
  
  }
  </code></pre>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      private BCryptPasswordEncoder passwordEncoder;
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer.tokenKeyAccess("permitAll()")
                     .checkTokenAccess("isAuthenticated()");
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
                 .withClient("my-client")
                 .secret(passwordEncoder.encode("secret"))
                 .authorizedGrantTypes("authorization_code", "client_credentials")
                 .scopes("user_info", "read", "write", "trust")
                 .autoApprove(true)
                 .accessTokenValiditySeconds(5000)
                 .redirectUris("http://localhost:8080/api/login");
      }
  }
  </code></pre>
  
  <pre><code>@Configuration
  @Order(1)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.requestMatchers()
              .antMatchers("/login", "/oauth/authorize")
              .and()
              .authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .formLogin().permitAll();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
              .withUser("john")
              .password(passwordEncoder().encode("john"))
              .roles("USER");
      }
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder(){
          return new BCryptPasswordEncoder();
      }
  
  }
  
  </code></pre>
  
  <p>API module: </p>
  
  <pre><code>server:
    servlet:
      context-path: /api
  security:
    oauth2:
      client:
        clientId: my-client
        clientSecret: secret
        accessTokenUri: http://localhost:8081/auth/oauth/token
        userAuthorizationUri: http://localhost:8081/auth/oauth/authorize
      resource:
        userInfoUri: http://localhost:8081/auth/user/me
  
  </code></pre>
  
  <pre><code>@Configuration
  @EnableOAuth2Sso
  @EnableWebSecurity
  public class OAuthConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.antMatcher("/**")
              .authorizeRequests()
              .antMatchers("/login**")
              .permitAll()
              .anyRequest()
              .authenticated()
              .and()
              .logout().permitAll()
              .and()
              .httpBasic().disable();
      }
  }
  </code></pre>
  
  <pre><code>@RestController
  public class DashboardController {
  
      @GetMapping("/demo")
      public String demo() {
          return "Hello";
      }
  }
  </code></pre>
  
  <p>When I got access_token - I can't get access to API.
  Please see screenshots below
  <a href="https://i.stack.imgur.com/MX6rU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MX6rU.png" alt="access_token"></a></p>
  
  <p><a href="https://i.stack.imgur.com/fn0EH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fn0EH.png" alt="not working"></a></p>