I took my token with postman

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6Imhha2FuMzMiLCJyZWFsbSI6ImRlZmF1bHQiLCJuYW1laWQiOiIzMDQxIiwibmJmIjoxNTUyMjU1MjM0LCJleHAiOjE1NTIyNTY0MzQsImlhdCI6MTU1MjI1NTIzNH0.iylysX2SMffzVTz3YELue-SIFMxm7qSLMFnkx_V1neo",
    "token_type": "bearer",
    "expires_in": 1200
}

I use this configuration in global asax

OAuth.ConfigureEndpoint("/oauth/token", new OAuthOptions
        {
            UserService = new UmbracoMembersOAuthUserService(),
            SymmetricKey = "856FECBA3B06519C8DDDBC80BB080553",
            AccessTokenLifeTime = 20, // Minutes
            AllowedOrigin = "*",
            AllowInsecureHttp = true // During development only
        });

this is my api controller

 [OAuth]
public class OrdersController : UmbracoApiController
{

    [HttpGet]
    [Authorize]
    public async Task<IHttpActionResult> List()
    {

        List<string> orders = new List<string>();
        orders.Add("Elma");
        orders.Add("Armut");
        orders.Add(Umbraco.Content(1057).Name);

        return base.Ok(orders);
    }
}

please help me I cant find What I missed for many hours.