WebApi authorization with JWT always return 401

Question

I'm trying to implement WebApi authorization with JWT token. But whatever I try to do - it's always return 401. Here is how it look like.

WebApiConfig.cs

    public static void Register(HttpConfiguration config)
        {
            config.MapHttpAttributeRoutes();
            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}",
                defaults: new { id = RouteParameter.Optional }
            );
        }

Startup.cs

     public void Configuration(IAppBuilder app)
        {
            HttpConfiguration config = new HttpConfiguration();
            ConfigureOAuth(app);
            WebApiConfig.Register(config);
            app.UseWebApi(config);

        }

        private void ConfigureOAuth(IAppBuilder app)
        {
            var issuer = "http://localhost:59640/";
            var audience = "099153c2625149bc8ecb3e85e03f0022";
            var secret = TextEncodings.Base64.Decode("IxrAjDoa2FqElO7IhrSrUJELhUckePEPVpaePlS_Xaw");

            // Api controllers with an [Authorize] attribute will be validated with JWT
            app.UseJwtBearerAuthentication(
                new JwtBearerAuthenticationOptions
                {
                    AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
                    AllowedAudiences = new[] { audience },
                    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                    {
                        new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
                    }
                });
        }

NuGet packages installed

Headers in 401 answer

Cache-Control →no-cache
Content-Length →90
Content-Type →application/json; charset=utf-8
Date →Wed, 26 Jul 2017 05:20:21 GMT
Expires →-1
Pragma →no-cache
Server →Microsoft-IIS/10.0
WWW-Authenticate →Bearer
X-AspNet-Version →4.0.30319
X-Powered-By →ASP.NET
X-SourceFiles →=?UTF-8?B?RDpcRGV2XGFncm9tYXNoXFRlc3RcYXBpXHRlc3Q=?=

Request headers

Authorization:Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1bmlxdWVfbmFtZSI6ImFuZHJleS5zaGVka29AZ21haWwuY29tIiwic3ViIjoiYW5kcmV5LnNoZWRrb0BnbWFpbC5jb20iLCJyb2xlIjoiQWRtaW4iLCJpc3MiOiJhZ3JvbWFzaC5hcGkiLCJhdWQiOiIwOTkxNTNjMjYyNTE0OWJjOGVjYjNlODVlMDNmMDAyMiIsImV4cCI6MTUwMTA0ODA2NiwibmJmIjoxNTAxMDQ2MjY2fQ.XkHk38NWcVXokzettDrngoL9BFiP_gEzswQaEYxVK10
Accept:application/json
Content-Type:application/json

What is interesting - when I changed Authorize attribute to custom authorize attribute it's even wasn't hit breakpoint inside custom authorize attribute but return 401. I spent few days already trying to solve this problem. Could you tell me please - what I'm doing wrong?
P.S. JWT token I did validate on jwt.io and look like it's ok.