SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

<@498057949541826571> I followed this documentation https://supertokens.com/docs/emailpassword/testing/testing-with-postman#3-refreshing-session-tokens but it responses as unathorized. Way produce this bug. I log in i get tokens. The access token expires in 10 seconds and after I try with refresh token it says unauthorized. These are the headers that i am using
```Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Content-Length: 0
fdi-version: 1.8,1.9,1.10,1.11,1.12,1.13
Host: admin.playbook.test
Origin: http://admin.example.test
Referer: http://admin.example.test
rid: session
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36```

Response
```{
    "message": "unauthorised"
}```

hey <@867066293361311815> it seems the refresh token is not being added.

Can you call the sign in API and show me the response and request headers as seen on chrome>

Request headers
```Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Content-Length: 98
Content-Type: application/json
Cookie: sIdRefreshToken=11954b3d-b7de-4e9c-8a46-fb26b81c25e3; sIRTFrontend=11954b3d-b7de-4e9c-8a46-fb26b81c25e3; sFrontToken=eyJ1aWQiOiIzYWQ1MzQwYy1kNzNmLTQ1MGMtODRkZi1jNzk0NjlhZTU2YTEiLCJhdGUiOjE2NzUxNTIwMjM4MzgsInVwIjp7fX0=
Host: admin.example.test
Origin: http://admin.example.test
Referer: http://admin.example.test/login
rid: anti-csrf
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36```

Response: I have modified the response so in response I get user details
```status: "OK"
user: {user_id: "3ad5340c-d73f-450c-84df-c79469ae56a1", email: "admin@test.com",…}```

In cookies i can see these things set
```
sIRTFrontend            
sIdRefreshToken        
sFrontToken        
sAccessToken
```

can you send me screenshot of response and request headers?

These are log in req and response headers

<@498057949541826571> That's the all response headers

can i see all the sign in response headers? You only sent part of the header screenshot

and also whats the URL you are using to sign in?

whats the apiBasePath on the frontend and backend?

the apiBasePath is /api/auth for frontent and in the backend the api basepath is not set so it should take /auth as dedault. My api is reunning in admin.playbook.test/api since i am using multitenant

you need to set the same apiBasePath on frontend and backend

Nope still the same issue. The reason i have /api/auth base in front end because I have api running in the same domain. For example if my app is running in app.example.test then my api is running in app.example.test/api.

If my basepath was wrong login should not have worked right but it's working fine

does the backend strip away the `/api` part of the route when hitting the auth server?

in this case, you should set the apiGatewayPath on the backend to `/api`

so frontend apiBasePath is `/api/auth`, backend apiBasePath is `/auth`  and backend apiGatewayPath is `/api`.

This should work

Yes thanks. This worked. Thanks a lot. 🙂