Ok. I figured it out. I needed to setup UserRoles for the backend in the config. This: https://supertokens.com/docs/userroles/initialisation . Wasn't so obvious that we needed to do that based only on reading the docs here: https://supertokens.com/docs/passwordless/common-customizations/sessions/protecting-frontend-routes#verifying-the-claims-of-a-session--pre.