In ur existing middleware, u can check if the path === ur login API’s path, then don’t call getSession, instead just call next(). And in your login API, u can call createNewSession