Is there an existing issue for this?
What happened?
📌 Issue Overview
The FastAPI /api/auth/login endpoint successfully authenticates users via Supabase but fails to return the access_token and session object in the response body. This prevents the frontend or API clients from making subsequent authenticated requests, as there is no JWT (JSON Web Token) available to include in the Authorization header.
🔍 Steps to Reproduce (via Postman)
- Signup: Send a
POST request to /api/auth/signup with user credentials to create a new account.
- Verification: Confirm the user account by clicking the link in the Supabase confirmation email.
- Login: Send a
POST request to /api/auth/login with the verified email and password.
- Inspect Response: Observe the JSON response. It contains a
user_id and success message but is missing the session object and access_token.
- Authenticated Request: Attempt a
GET request to a protected endpoint (e.g., /analytics/creator/dashboard-stats) using the expected Bearer token. It will fail with 401 Unauthorized or an algorithm mismatch error because no valid token was provided during login.
🎯 Expected Behavior
The login endpoint should return the full Supabase session object, which includes the access_token, refresh_token, and expires_in fields.
🚨 Actual Behavior
The endpoint currently returns a custom dictionary that excludes session data, effectively losing the JWT required for client-side authentication.
📷 Screenshot
Postman screenshot here showing the login response missing the "session" key:
💡 Suggested Improvements
The Faulty Code
File:backend\app\api\routes\auth.py
The current implementation only extracts the user ID and ignores the session metadata returned by the Supabase SDK.
return LoginResponse(
message="Login successful.",
user_id=user.id,
email=user.email,
role=profile.get("role"),
name=profile.get("name"),
onboarding_completed=profile.get("onboarding_completed", False)
)
The Reason
The supabase.auth.sign_in_with_password() method returns an AuthResponse object containing both user and session properties. By manually constructing a return dictionary that excludes res.session, the backend fails to pass the necessary JWT back to the client. Without this session object, the frontend cannot authorize requests to protected routes.
The Recommended Fix
Update the return statement to include the full session object. This ensures the frontend receives the access_token needed for the Bearer authentication header.
Record
Is there an existing issue for this?
What happened?
📌 Issue Overview
The FastAPI
/api/auth/loginendpoint successfully authenticates users via Supabase but fails to return theaccess_tokenandsessionobject in the response body. This prevents the frontend or API clients from making subsequent authenticated requests, as there is no JWT (JSON Web Token) available to include in theAuthorizationheader.🔍 Steps to Reproduce (via Postman)
POSTrequest to/api/auth/signupwith user credentials to create a new account.POSTrequest to/api/auth/loginwith the verified email and password.user_idand success message but is missing thesessionobject andaccess_token.GETrequest to a protected endpoint (e.g.,/analytics/creator/dashboard-stats) using the expected Bearer token. It will fail with401 Unauthorizedor an algorithm mismatch error because no valid token was provided during login.🎯 Expected Behavior
The login endpoint should return the full Supabase
sessionobject, which includes theaccess_token,refresh_token, andexpires_infields.🚨 Actual Behavior
The endpoint currently returns a custom dictionary that excludes session data, effectively losing the JWT required for client-side authentication.
📷 Screenshot
Postman screenshot here showing the login response missing the "session" key:
💡 Suggested Improvements
The Faulty Code
File:backend\app\api\routes\auth.py
The current implementation only extracts the user ID and ignores the session metadata returned by the Supabase SDK.
The Reason
The supabase.auth.sign_in_with_password() method returns an AuthResponse object containing both user and session properties. By manually constructing a return dictionary that excludes res.session, the backend fails to pass the necessary JWT back to the client. Without this session object, the frontend cannot authorize requests to protected routes.
The Recommended Fix
Update the return statement to include the full session object. This ensures the frontend receives the access_token needed for the Bearer authentication header.
Record