Hey everyone I am using passwordless flow to send password e

Question

Hey everyone I am using passwordless flow to send password email OTP s Now I want to do some checks in my backend in `consumeCode` section but I am unable to get the login type phone email The reason I need login type is to determine what is the input I am getting and accordingly check for the relevant user in the backend Can anyone please enlighten me here

rp · Answer

Hey

rp · Answer

One of the inputs to the consume code api is preAuthSessionId

rp · Answer

That can be used to get the login info email or phone used via the passwordless recipe s function

rp · Answer

https supertokens com docs nodejs modules recipe passwordless html

rp · Answer

See the listCodesByPreAuthSessionId function

mib200 · Answer

Thanks < rp>

mib200 · Answer

Also I want to customise the response of ` api auth signinup code consume` endpoint

mib200 · Answer

instead of just using cookies I want to return `accessToken` for mobile clients

mib200 · Answer

can we do that

rp · Answer

You can But I would really recommend not to do that or wait a week or so when we release header based auth Manually sending back and handling the access token can cause a lot of bugs

mib200 · Answer

this is kind of urgent so a short term patch will work for me < rp>

mib200 · Answer

can you please point me in right direction

rp · Answer

What do you intend to do with the access token

rp · Answer

If you want to send it to a third party or something then you should use the JWT instead

rp · Answer

But if you really want to just use the session s access token then see the page about customising api response

rp · Answer

https supertokens com docs passwordless advanced customizations apis override custom response api override

mib200 · Answer

Yeah JWT will do the use case is that I have a cordova app Now The SMS based OTP verification works but problem is that the cookie isn t setting because request is from localhost And my auth domain is hosted at `auth example com`

mib200 · Answer

So sub domain session sharing and all works but since multiple root domains are not supported right now I can t use localhost in this case

mib200 · Answer

same is the issue when we offer it to clients at `xyz com` and want to use the above `auth example com` as central auth location

rp · Answer

right In this case you want to redirect the user back to the original app from auth example com with the JWT in the query params

rp · Answer

what you want to do is explained here https discord com channels 603466164219281420 1063204961112051733 1063329411425914934

mib200 · Answer

hmm ok let me try that as well

mib200 · Answer

< rp> please also tell me the patch as well just in case the ideal way is too long for our delivery timelines

rp · Answer

See the link i had sent you above It shows you how to modify the API response

mib200 · Answer

ok let me check that

mib200 · Answer

thanks again for your help

mib200 · Answer

you are a savior

mib200 · Answer

< rp> sorry to bother you again but I am able to get the JWT but how do I get the refresh token in backend

mib200 · Answer

I see the express example for localstorage usage re writes the Cookie headers but I am unable to do the same in NextJS

mib200 · Answer

any idea why that is the case

mib200 · Answer

< rp> or is there any method using which we can get refresh tokens I can see methods to get accessToken from Session but not refresh tokens

rp · Answer

you don t need to get the refresh token

rp · Answer

once you have the jwt send it to the target app

rp · Answer

as a query param

rp · Answer

on the target app read the JWT and send that to its backend The backend will verify the JWT and create its own session using our session recipe

mib200 · Answer

you mean I can get the session created to a different domain as well if I pass the JWT to backend I don t think my cross domain example will work even if I do this

rp · Answer

You will have to create a new session based on the sub claim in the JWT on the target app

rp · Answer

So you will have two different sessions

rp · Answer

One on auth example com

rp · Answer

And one on xyz com

mib200 · Answer

hmm this is a bit confusing at the moment Just to summarise even if my API is hosted at `auth example com` my JWT token that I received on `xyz com` can request for session to be generated at `xyz com` using that JWT token

mib200 · Answer

if that is the case this would solve LOT of issues

rp · Answer

on xyz com you will need to verify the jwt token using any jwt verification lib

rp · Answer

and then create a new session using the session createNewSession function

mib200 · Answer

aah I think the logic you are placing is that both the domains are hosted with their Supertokens NodeJS SDK s connected with a common Supertokens core backend

rp · Answer

yup

mib200 · Answer

that way they will be able to create sessions based on a common JWT

rp · Answer

yup

mib200 · Answer

interesting