Windows authentication returns 403 - Forbidden - kerberos

Question

I have 2 systems
web which runs as windows service on kestrel
web api which also runs as windows service on kestrel, but runs on another machine
In web aplication i have windows authentication which works fine, but when i call web api (from web app) which also uses windows authentication, call ends in 403 error. This happens only when web and web api are on different machines, when they are on same machines call succeeds.
Call on web app is impersonated to logged user.
controller in web app:
[Authorize(AuthenticationSchemes = NegotiateDefaults.AuthenticationScheme)]
public async Task<IActionResult> Index()
{
var data = await testService.GetData();
return View("Index",data);
}
Call from web app (TestService.GetData):
var identity = (WindowsIdentity)httpContextAccessor.HttpContext.User.Identity;
return await WindowsIdentity.RunImpersonatedAsync(identity.AccessToken, async () =>
{
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(NegotiateDefaults.AuthenticationScheme);
var result = await httpClient.GetAsync("api/auth");
return await result.Content.ReadAsStringAsync();
});
Web api controller:
[Authorize(AuthenticationSchemes = NegotiateDefaults.AuthenticationScheme)]
public string Get()
{
...
}
When call is not impersonated or both apps are on same machine, everything is correct. But i need to make call in context of signed user and apps needs to be on different machines.
I think the problem is ntlm is used onstead of kerberos and something like this is not permitted in ntlm. But how to force use kerberos, or what is the reason kerberos is not used by default?
spns are set on both machines:
setspn -S HTTPS/{servername on which app is running} {service user under which app is running}
Any idea what i should else set or what can be problem?