asp.net web api - WebApi authorization with JWT always return 401 -

i'm trying implement webapi authorization jwt token. whatever try - it's return 401. here how like.

webapiconfig.cs

    public static void register(httpconfiguration config)         {             config.maphttpattributeroutes();             config.routes.maphttproute(                 name: "defaultapi",                 routetemplate: "api/{controller}/{id}",                 defaults: new { id = routeparameter.optional }             );         } 

startup.cs

     public void configuration(iappbuilder app)         {             httpconfiguration config = new httpconfiguration();             configureoauth(app);             webapiconfig.register(config);             app.usewebapi(config);          }          private void configureoauth(iappbuilder app)         {             var issuer = "http://localhost:59640/";             var audience = "099153c2625149bc8ecb3e85e03f0022";             var secret = textencodings.base64.decode("ixrajdoa2fqelo7ihrsrujelhuckepepvpaepls_xaw");              // api controllers [authorize] attribute validated jwt             app.usejwtbearerauthentication(                 new jwtbearerauthenticationoptions                 {                     authenticationmode = microsoft.owin.security.authenticationmode.active,                     allowedaudiences = new[] { audience },                     issuersecuritytokenproviders = new iissuersecuritytokenprovider[]                     {                         new symmetrickeyissuersecuritytokenprovider(issuer, secret)                     }                 });         } 

nuget packages installed

<package id="microsoft.aspnet.webapi" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.client" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.client.ru" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.core" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.core.ru" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.owin" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.webhost" version="5.2.3" targetframework="net461" />   <package id="microsoft.aspnet.webapi.webhost.ru" version="5.2.3" targetframework="net461" />   <package id="microsoft.codedom.providers.dotnetcompilerplatform" version="1.0.0" targetframework="net461" />   <package id="microsoft.identitymodel.logging" version="1.1.4" targetframework="net461" />   <package id="microsoft.identitymodel.tokens" version="5.1.4" targetframework="net461" />   <package id="microsoft.net.compilers" version="1.0.0" targetframework="net461" developmentdependency="true" />   <package id="microsoft.owin" version="3.1.0" targetframework="net461" />   <package id="microsoft.owin.host.systemweb" version="3.1.0" targetframework="net461" />   <package id="microsoft.owin.security" version="3.1.0" targetframework="net461" />   <package id="microsoft.owin.security.jwt" version="3.1.0" targetframework="net461" />   <package id="microsoft.owin.security.oauth" version="3.1.0" targetframework="net461" />   <package id="newtonsoft.json" version="9.0.1" targetframework="net461" />   <package id="owin" version="1.0" targetframework="net461" />   <package id="system.identitymodel.tokens.jwt" version="4.0.3.308261200" targetframework="net461" /> 

headers in 401 answer

cache-control →no-cache content-length →90 content-type →application/json; charset=utf-8 date →wed, 26 jul 2017 05:20:21 gmt expires →-1 pragma →no-cache server →microsoft-iis/10.0 www-authenticate →bearer x-aspnet-version →4.0.30319 x-powered-by →asp.net x-sourcefiles →=?utf-8?b?rdpcrgv2xgfncm9tyxnoxfrlc3rcyxbpxhrlc3q=?= 

request headers

authorization:bearer eyj0exaioijkv1qilcjhbgcioijiuzi1nij9.eyj1bmlxdwvfbmftzsi6imfuzhjles5zagvka29az21hawwuy29tiiwic3viijoiyw5kcmv5lnnozwrrb0bnbwfpbc5jb20ilcjyb2xlijoiqwrtaw4ilcjpc3mioijhz3jvbwfzac5hcgkilcjhdwqioiiwotkxntnjmjyynte0owjjogvjyjnlodvlmdnmmdaymiisimv4cci6mtuwmta0oda2niwibmjmijoxntaxmdq2mjy2fq.xkhk38nwcvxokzettdrngol9bfip_gezswqaeyxvk10 accept:application/json content-type:application/json 

what interesting - when changed authorize attribute custom authorize attribute it's wasn't hit breakpoint inside custom authorize attribute return 401. spent few days trying solve problem. tell me please - i'm doing wrong?
p.s. jwt token did validate on jwt.io , it's ok.

i've checked jwt token. if i'm right, 'exp' time passed, token invalidated time.