rp_st
04/29/2021, 4:27 AMhttpOnly
cookie which means the JS on the frontend can't read it. This is done for security purposes (preventing token theft via XSS).
If you want just the payload / user info on the frontend, you can see https://test.supertokens.io/recipe-redirect?to=common-customizations/sessions/user-information-front-end
And if you really want the access token itself on the frontend, you can create an API that does session verification and returns the access token as a response (but I wouldn't recommend it).