I don't know if this is a bug in Magento 2 API or not, so I didn't post it on Magento 2 Github issues.
According to this link: http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-session.html:
Customers can access resources that are configured with anonymous or self permission in the webapi.xml configuration file.
I tried login Magento 2 storefront, then I went to
magento_host/rest/V1/customers/me on the browser (which has "self" permission), I still got error
Consumer is not authorized to access %resources
I tried to create a custom API which also has "self" permission, I got the same error.
I'm using Magento 2.1.7.
Anyone know why? Thank you.