oui, le token est bien dans les headers de la requete :
Request Header
Accept:application/json, text/plain, /
Accept-Encoding:gzip, deflate, sdch, br
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Authorization:Bearer eyJhbGciOiJSUzI1NiJ9.......rAys0YkLvRCzgwfQegUmuqi-roaCx7O-oUcmGOrv3vWXE
Cache-Control:no-cache
Connection:keep-alive
Cookie:PHPSESSID=ravmf75pu5f6et5ergh5ld2c94
Host:localhost
Pragma:no-cache
Referer:http://localhost/Myapp/src/
User-Agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Mobile Safari/537.36
Response Header
Cache-Control:no-cache
Connection:Keep-Alive
Content-Length:22
Content-Type:application/json
Date:Wed, 29 Mar 2017 09:24:40 GMT
Keep-Alive:timeout=5, max=98
Server:Apache/2.4.9 (Win64) PHP/5.5.12
X-Debug-Token:59c552
X-Debug-Token-Link:http://localhost/ws/web/app_dev.php/_profiler/59c552
X-Powered-By:PHP/5.5.12
General
Request URL:http://localhost/ws/web/app_dev.php/api/list
Request Method:GET
Status Code:401 Unauthorized
Remote Address:[::1]:80
Referrer Policy:no-referrer-when-downgrade