I am developing an admin panel where only the admin can create new accounts. Everything works well in local, but for some reason in production, I can't create an user. It always return me:

"try refresh token".

and every other endpoint works well. But if I comment the

verifySession()

in production I can create the user.

Hey! Let’s talk here. Which version of the SDK?

9.1.1

ok, let me try

And then run it in production like

DEBUG=com.supertokens node index.js

ok

I see. so this is for prod use?

yes, it is intentional for now, because I am running it locally but with al others variables from the cloud

ah right! then you should pass

rid: "anti-csrf"

as a header in your request

😍 😍 😍 😍 😍 😍 😍 😍 😍 😍 😍 😍 😍 😍

because the backend domain's top level domain is not the same as the website domain, you need csrf protection when querying the API. One way to do that is by adding a custom header. So we add

rid: "anti-csrf"

. Since this is missing from the postman request, the verifySession rejects the request (for security)