asp.net - Error 401 Unauthorized. How to Use the same token for different Urls? -

in asp.net identity using oauth2 token created once user authenticated posting user , password.

before making call action 1 api, user must ask token:

http://mysite/auth/token 

once token received, web api calls can done, sending the

authorization: bearer <token> header:

get http://mysite/auth/product/1 put http://mysite/auth/client/42 

i have several web apis use centralised security system authentication, problem receive unauthorizaed (401) when try call different api (with different url). example:

get http://mysite/myapi/product/1 

if security centralised , both apis using same users database authentication, how can use same token different urls?

finally found solution adding same machinekey tag in both web.config files:

<system.web> ... <machinekey validationkey="57b449bba8f9e656087ff7848727e122c5f5966f65ac0fc25fb3532193b59cfcd13b370883ffc184c1f1500638f33e6f67b37caed1d9bc65bbc6cffb232bfd0b" decryptionkey="6d9fbe88d16b3fa5b5e6b37460bbe50da85d5b4c482159006b5a337c58aa9e79" validation="sha1" decryption="aes" /> ... </system.web> 

as suggested on accepted answer here using machinekey generator.

from documentation:

sharing authentication tickets across applications
if need single logon work across multiple applications located in separate virtual directories, need share common authentication ticket. configure common authentication ticket, must manually generate validationkey , decryptionkey values , ensure each application shares these values. if want share tickets across applications on server can set these manual values on element in machine level web.config file. share tickets across specific applications, can use element common validationkey , decryptionkey values in relevant application's web.config files.

updated - security warning

security warning

there many web sites generate element click of button. never use element obtained 1 of these sites. impossible know whether these keys created securely or if being recorded secret database. should ever use configuration elements created yourself.

read appendix on link know how generate own machinekey element.