The problem is this is not Bearer Token. You should provide your own header Authorization with value Token: <token>. Apps like Postman doesn't have this type of authorization header builtin, so you need to add it manually.