Custom authentication provider returns 403 for _access: 'TRUE'
Routes need to specify the authentication providers they want to support.

By default, that's session, so authenticating with something else is not allowed.

You do this by specifying _auth: ['your_authentication_provider'] within the options: key of your route.