extract the tokens from supabase auth to query another API

[latifs]

hey guys,
I wanted to use supabase auth so bad in my nextJS 14 app.
I use the new ssr module and the client and server middleware function available in the docs.
and all is well in the world for login in and stuff put I'd like to use the information from the auth (access_token and refresh token) to access another express server that is just expecting that token to be attached to the requests.
why can't I just extract the tokens from the client and attach them to my fetch request in the nextJS api?
it shouldn't be that hard

[GaryAustin1]

You can pass the access token. You can't really use the refresh token though as it can only be used once and it will be used on your nextJS app.
So the issue is you have to use the access token before it expires. If you need the access token for a long period of time you would need to pass info from your nextJS app serverside to your express server encoding as you need.

[latifs]

Hey @GaryAustin1 ,
yeah sounds good, what is the easiest way to get that access_token though?

[GaryAustin1]

It is the session from getSession on a Browser. Auth-helpers/SSR should have it also but because they have warnings about using getUser, I'll defer on how you get them there. But I see access_token passed around in their code examples.

[latifs]

Thanks,
does it mean that I have to do this every time I need to query the remote API:

const serverClient = createClient();
const session = await serverClient.auth.getSession();
console.log('access_token:', session.data?.session?.access_token);

...

and then attach it to the fetch request?

it seems overkill: I'd like to create a middleware on the nextJS api to intercept the requests made from the nextJS Api to the remote API.
Any pointers on that?

[GaryAustin1]

Sorry, I don't use nextJS or SSR. You certainly need a current token as it can be a minute or so from expiring worst case based on the supabase-js refresh code.
You might try Discord as it is more interactive and many discussions along these lines.

[hanglooakshay]

@latifs, were you able to resolve this? Attaching it to each fetch request instead of using simple middleware seems overkill. I am also stuck in a similar problem.