The found solution is my-self on scope issue, maybe it will be useful for someone marked ** in config:
'modules' => [ 'oauth2' => [ 'class' => 'filsh\yii2\oauth2server\Module', 'tokenParamName' => 'accessToken', 'tokenAccessLifetime' => 3600 * 24, 'storageMap' => [ 'client_credentials' => 'app\models\User', 'user_credentials' => 'app\models\User', **'scope' => 'app\models\User',** ], 'grantTypes' => [ 'client_credentials' => [ 'class' => '\OAuth2\GrantType\ClientCredentials', 'allow_public_clients' => false, 'always_issue_new_refresh_token' => true ], 'user_credentials' => [ 'class' => 'OAuth2\GrantType\UserCredentials', ], 'refresh_token' => [ 'class' => 'OAuth2\GrantType\RefreshToken', 'always_issue_new_refresh_token' => true ] ] ] ],
source share