I use this library on sever side, while on client side do manually since the client is for mobile platform.

This is my openapi spec :
I follow openapi documentation to define security scheme

paths:
  /admins:
    get:
      description: Get AdminList
      security:
        - bearerAuth: []
      operationId: getAdminList
    
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

And in my request I put Authorization header on request
Authorization: Bearer ---random JWT token ----

But I always get 'Security requirements failed' from validation middleware (the JWT token was checked and valid)
Am I missing something ?

PS: also it return http error 403, while above documentation recommending to return http 401 error for unauthorized request.