hello @rp , can we retrieve the "Access token" from the requests manually?

Currently we have another services that need to validate their received request, we want to get the access token and send it to the auth service to validate it, how can we achieve it? Thank you

that you get from using VerifySession middleware

we intend to deploy using the same domain though

If i understand correctly, Supertokens will attach the access token to each api in need of authorize right?

right. So then you do have access to the session object in that API which receives the cookie?

if you do have that, then you can do

session.GetAccessToken()

Or, are you talking about the JWT (since in our previous conversation, I had asked you to enable JWT feature)

Look at this: https://supertokens.com/docs/session/common-customizations/sessions/with-jwt/read-jwt#method-1-after-session-verification

I mean, the API which the frontend queries, does that get the supertokens' cookies? If yes, how do you verify those if you don't use our lib?

Now, to verify the session in other, you will have to use our golang lib and initialise the session recipe there

And then we have a middleware like VerifySession which you can use to verify the session from the cookies. That function does everything that’s required to check if a session is fine or not

Once that function runs successfully, it will attach a session object in the context which you can get in your API logic. Using that session object, you can get the JWT from it (as shown in the link above) and send that to other micro services which can go about doing normal JWT verification.

So for the “others” part, you may wanna check out our sessions only recipe setup: https://supertokens.com/docs/session/quick-setup/backend

Hope this clarifies things

(Renamed this thread to be more appropriate)