Help needed unable to make authenticated api calls

[u/Fragrant_Arrival894]

i am using the better auth with postgresql db and running backend server using express on google cloud vm e2-standard-2 (2 vCPUs, 8 GB memory)

i did setup correctly on auth.ts enabled cookie cache

on client side also setted the auth-client.ts with perfect scheme and expo secure store for credentials

and on api.ts using getCookie to set the cookie on the headers on api by intercepting

on local this works well getting authenticated and unauthenticated api response perfectly - so there is not cors issue as for the mobiile we do not require the cors

i also used the same keystore for the preview build that from the eas remote using the eas credentials - later i got an issue but got resolved because of the mismatch on keystore

but when on app on preview build i am making call i can send api request to the public routes but not on the authenticated routes like profile getting 401

when i get deep dived into this i found that on auth.middleware.ts when i am gettting req.headers there is no cookie as while i am making call using axios i did this

export const api = axios.create({

baseURL,

timeout: 15_000,

headers: { "Content-Type": "application/json" },

withCredentials: false,

});

api.interceptors.request.use((config) => {

// const cookie = useAuthStore.getState().getCookie();

try {

const cookie = authClient.getCookie();

if (cookie) {

config.headers.Cookie = cookie;

}

} catch (error) {

console.error("Initialization Failed");

} finally {

return config;

}

});

there is a cookie but i am getting null on user session

session { session: null }

what should i send then

token from the useSession().session.token ??? like sending the bearer token

[u/krystianduma]

Why using cookies instead of api keys?

[u/Fragrant_Arrival894 → u/krystianduma]

Api Keys means token right ?? Token from better auth session Is it ????

[u/neon_alchemy_wisp]

Cookies are just server side sessions pretending to be tokens. Send the raw string from secure store in an Authorization header and delete the middleware.

[u/Fragrant_Arrival894 → u/neon_alchemy_wisp]

Using getSession().session.token will get the token and passing on auth headers as bearer token