Howdy again folks. I am doing some API testing right now using Postman to ensure that my FastAPI path operations are validating that the user has the required roles. I created a JWT token using the docs, however I am getting a 401 response when trying to hit any of the endpoints. I set a base FastAPI dependency of verify_session().

Hi

i think i figured out what i was doing wrong. in my Depends statement I was passing the result of verify_session() instead of the callable

So the backend APIs use cookies to verify sessions, have you checked the testing with postman docs?

Oh no I didn't know there were docs on that

I can point you to it, what recipe are you using?

all good, i can find it 🙂

Awesome, in case you dont spot it it’s a separate section in the recipe docs

I think I'm still stuck on this actually

So you want to enable using JWTs for the session recipe

yes. and i saw that info in the docs.

This would generate a JWT in the session data that you can then use

yes

So a couple things: - Yep you need to set the issuer to match the api domain and base path with the ones you use in supertokens init - SuperTokens does not verify JWTs, you would have to build this yourself

so what does adding JWConfig to the session init func do

With enable true, it will store the jwt in your session data and provide an API endpoint that is used by JWKS verifiers to fetch the public key to verify the JWT

ah i see

So for example if you were to use auth0's library to verify the JWT, you can provide it with a jwks endpoint which would be an PAI exposed by the JWT recipe

right

So unless you absolutely need to use JWTs, I would recommend going with cookies. But if you want to stick with JWTs, you would need to add some custom middleware to your backend to verify the JWT and use that instead of the verifySession middleware that SuperTokens provides

cookies would work with postman?

Yep the docs should explain how, also you can trigger the sign up flow from postman itself and cookies would still work

hm

The only thing that wont work is auto refreshing of the session since thats something our frontend SDKs would do normally

let me see if that works one second

Thanks for the kind words! and we are happy to help

ohhh

Yep as part of the access token payload

yeah thats not a bad compromise

But you stick to cookies you dont even need to enable JWTs unless you need to integrate with a service that requires JWTs

ok ill test with just cookies

Awesome