title: .net 4.6 web api2 401 Unauthorized with identity server 4
body: <p>I have already a working identity server 4 in a .net core application.</p>
  
  <pre><code>namespace IdentityServer
  {
      public class Config
      {
          public static IEnumerable&lt;ApiResource&gt; GetApiResources()
          {
              return new List&lt;ApiResource&gt;
              {
                  new ApiResource("myresourceapi", "My Resource API")
                  {
                      Scopes = {new Scope("apiscope")}
                  }
              };
          }
  
          public static IEnumerable&lt;Client&gt; GetClients()
          {
              return new[]
              {
                  // for public api
                  new Client
                  {
                      ClientId = "secret_client_id",
                      AllowedGrantTypes = GrantTypes.ClientCredentials,
                      ClientSecrets =
                      {
                          new Secret("secret".Sha256())
                      },
                      AllowedScopes = { "apiscope" }
                  }
              };
          }
      }
  }
  
  namespace IdentityServer
  {
      public class Startup
      {
          // This method gets called by the runtime. Use this method to add services to the container.
          // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddIdentityServer()
              .AddDeveloperSigningCredential()
              .AddOperationalStore(options =&gt;
              {
                  options.EnableTokenCleanup = true;
                  options.TokenCleanupInterval = 30; // interval in seconds
               })
              .AddInMemoryApiResources(Config.GetApiResources())
              .AddInMemoryClients(Config.GetClients());
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
  
              app.UseIdentityServer();
              app.UseRouting();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapGet("/", async context =&gt;
                  {
                      await context.Response.WriteAsync("Hello World!");
                  });
              });
          }
      }
  }
  </code></pre>
  
  <p>The problem is that now I need to make authenticated requests to a .net 4.6 web api2 (not core). And the IdentityServer4.AccessTokenValidation package doesn't work for that.
  According to this question (<code>https://stackoverflow.com/questions/41992272/is-it-possible-to-use-identity-server-4-running-on-net-core-with-a-webapi-app-r</code>) all I have to do is to use the same package that was used for Identity server 3(IdentityServer3.AccessTokenValidation).
  This is the code i have implemented in the webapi 2</p>
  
  <pre><code>using IdentityServer3.AccessTokenValidation;
  using Microsoft.Owin;
  using Owin;
  using Microsoft.Owin.Host.SystemWeb;
  using IdentityModel.Extensions;
  using System.Web.Http;
  
  [assembly: OwinStartup(typeof(WebApplication10.Startup))]
  
  namespace WebApplication10
  {
      public partial class Startup
      {
          public void Configuration(IAppBuilder app)
          {
              app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
              {
                  Authority = "https://localhost:44357",
  
                  // For access to the introspection endpoint
                  ClientId = "secret_client_id",
                  ClientSecret = "secret".ToSha256(),
                  RequiredScopes = new[] { "apiscope" }
              });
  
          }
      }
  }
  
  namespace WebApplication10.Controllers
  {
      public class ValuesController : ApiController
      {
          [Authorize]
          // GET api/values
          public IEnumerable&lt;string&gt; Get()
          {
              return new string[] { "value1", "value2" };
          }
      }
  }
  </code></pre>
  
  <p>The status i get all the time is 401 Unauthorized.
  Am i doing something wrong?
  Any help with this?
  Thanks.</p>