SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

Does protected endpoints need some extra configuratoin for JWT? Because I have JWT enabled (https://supertokens.com/docs/microservice_auth/jwt-creation), but a curl test on the endpoint does not work, e.g.:
```
@app.get("/bla")
async def get_session_info(session: SessionContainer = Depends(verify_session())):
  return true
```

Verify_session doesn’t work with jwts. It’s meant only for session management verification from the frontend

For JWT Verifciation, use any standard JWT verification lib

Does that mean I can not make one endpoint available for both authentication methods? (either one?)

You can. You make make your own middleware which tries both the verification methods

verify_session takes a config which allows it to return none in case a sesion doesn’t exist. So if it returns none, try for normal JWT auth. And if that fails too, reject the request

ohhh okay thanks <@498057949541826571> sounds like a nice feature 😄