Had the same problem as darren11. The 405 is really misleading, making you believe that you have a problem with the url/method itself. If it was a 405 but stating that the jwt scope was a fault, I would not have spent one hour+ pulling the tiny hairs I have left... Scope is only for GET apparently. I would have love this to be for other method than GET, it was a pretty cool security feature. What a pity.