"name": "Unauthorized",
  "message": "Your request was made with invalid credentials.",
  "code": 0,
  "status": 401,
  "type": "yii\web\UnauthorizedHttpException"

public static function findIdentityByAccessToken($username, $password = null)
    {
        // throw new NotSupportedException('"findIdentityByAccessToken" is not implemented.');
        //return static::findOne(['username' => $username]);

        $user = static::findOne(['username' => $username]);
        if ($user != null and $user->validatePassword($password)) {
            return $user;
        } else {
            return null;
        }
    }

public function validatePassword($password)
    {
        $hash = Yii::$app->getSecurity()->generatePasswordHash($password);
        return Yii::$app->getSecurity()->validatePassword($password, $this->password_hash);
    }