Stormpath安全休息api

Question

我按照这里的示例https://stormpath.com/blog/the-ultimate-guide-to-mobile-api-security

并在此获取访问令牌

https://support.stormpath.com/hc/en-us/articles/225610107-How-to-Use-Stormpath-for-Token-Management

"use strict";

import { ApiKey } from 'stormpath'; 
import { Client } from 'stormpath';

let apiKey = new ApiKey(process.env.STORMPATH_API_KEY_ID,
     process.env.STORMPATH_API_KEY_SECRET);

let spClient = new Client({apiKey: apiKey });

spClient.getApplication(process.env.STORMPATH_APPLICATION_HREF,
   function(err, app) {

    var authenticator = new OAuthAuthenticator(app);

    authenticator.authenticate({
        body: {
            grant_type: 'password',
            username: username,
            password : password
        }
    }, function (err, result) { 
        if (!err) console.log(err);
        res.json(result.accessTokenResponse);
    });
});

我能够获得access_token。我使用此令牌通过Header Authorization Bearer {access_token}

来点击我的api

但是，当我放入中间件stormpath.apiAuthenticationRequired时，我会继续收到此警告，并且我的api将返回401

(node:57157) DeprecationWarning: JwtAuthenticator is deprecated, please use StormpathAccessTokenAuthenticator instead.