Update:
I tried setup demo-pro, and everything works. It looks like problem is when using community headless edition and policies defined in policies.json file. Then there is somewhere problem to link the policies from the file to the actual bearer token audition.
In pro version works oauth app and machine-to-machine to.
I try to investigate configuration differences between CE and PRO.