Is it possible to change the header where the authorization bearer is placed? E.g. use st-authorization instead of authorization

Hey. You can do this by writing your own interceptors on the frontend for XHR / fetch that changes the header used to your custom one

Thanks I checked the docs. But how can I use this for the SDK API like signup etc?

thats where your interceptors come in

I mean on the backend, sorry

so to the backend supertokens middleware, you give the request / response object (based on your frameworks). You can make your own request / response wrappers that conform with our BaseReqeust (https://github.com/supertokens/supertokens-node/blob/master/lib/ts/framework/request.ts) and BaseResponse (https://github.com/supertokens/supertokens-node/blob/master/lib/ts/framework/response.ts) types, and then pass those to the middleware. In those custom wrappers, when a function like getHeaderValue(key) is called, you should check if the key is

authorization

and if it is, read from your custom header instead.

Thanks, but it is still not very clear where I should do this. I use python with flask, I think I have to overwrite the class Middleware in supertokens_python/framework/flask/flask_middleware.py?

right yea, i don't think you can override that particular function - but you can copy it into your code base and use that instead of ours. And then wherever in the function we are wrapping the flask request with our wrapper impl, you should wrap it instead with your wrapper impl

Yes I thought about copy pasting it. I found cookie_and_header.py:get_token(). I think in python I could patch just this function to extract the token not from AUTHORIZATION_HEADER but something else

oh yea. I guess that would be the best way. But im not sure how you could patch that function specifically.

I thought about monkey patch it like cookie_and_header.get_token = my_func

you could do that. However, that's an internal function. So patch updates might break your code

Indeed. Though already thanks for the help

Right. Verify session is another middleware which you would have to copy (just like the supertokens middleware)

Yeah, figured it out too, I have now overwritten verify session too.