What is the request that you are sending?

And which recipes have you initialised on the backend?

import JsonWebToken from 'jsonwebtoken'; // Truncated for display let certificate = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhki...\n-----END PUBLIC KEY-----"; let jwt = "..."; JsonWebToken.verify(jwt, certificate, function (err, decoded) { let decodedJWT = decoded; // Use JWT });

python: auth_header = request.headers.get('Authorization') if auth_header: try: token = auth_header.split(' ')[1] cert_str = '''-----BEGIN PUBLIC KEY---- xwIDAQAB -----END PUBLIC KEY-----''' cert_obj = load_pem_x509_certificate(cert_str, default_backend()) public_key = cert_obj.public_key() decoded_token = jwt.decode(token, public_key, algorithms=['RS256']) # Your code to handle the valid token here return JsonResponse({'message': 'Token is valid'}) except jwt.DecodeError: return JsonResponse({'error': 'Invalid token'}, status=401) else: return JsonResponse({'error': 'Authorization header is missing'}, status=401)

recipes list: recipe_list=[ session.init(), # initializes session features passwordless.init( flow_type="USER_INPUT_CODE", contact_config=ContactEmailOrPhoneConfig() ), jwt.init(), ],

MIDDLEWARE = [ "django.middleware.security.SecurityMiddleware", "django.contrib.sessions.middleware.SessionMiddleware", "corsheaders.middleware.CorsMiddleware", "django.middleware.common.CommonMiddleware", "django.middleware.csrf.CsrfViewMiddleware", "django.contrib.auth.middleware.AuthenticationMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", "debug_toolbar.middleware.DebugToolbarMiddleware", "debug_toolbar_force.middleware.ForceDebugToolbarMiddleware", "supertokens_python.framework.django.django_middleware.middleware", ]

in the session.init function call, you should enable jwt as well as shown here: https://supertokens.com/docs/session/common-customizations/sessions/with-jwt/enabling-jwts

Also, the certificate that you have in your code:

let certificate = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhki...\n-----END PUBLIC KEY-----";

where does that come from?

what should i do for that?

where can i c the error stack?

You can read it from the session's payload as shown in our docs

is there any limit for OTP validation for same phonenumber

also, please create different threads

for different questions