I was getting myself crazy, but I found someone with my same issue:
@Pavel_p did you finally have to move your service to ORDS or was able to figure out how to manage to control security with Apex only?
no, I did not move anything anywhere. For the life of me I was not able to invoke the service no matter what I tried (either declaratively or with PL/SQL...whatever - the service stubbornly responded with 401). From my point of view is such a service secured really well. I put a lot of time and effort into this with absolutely no success, way more than it deserved, so I gave up as I'm not going to spend the rest of my life trying to invoke a secured REST service created in APEX and instead writing REST services in NetBeans https://netbeans.org/kb/docs/websvc/rest.html .
From my point of view is such a service secured really well
Your comment is brilliant! jajajjajajjajaa