> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# User session and authorization

## Get a user's session token from a request

When your app frontend sends a request to your server, include the current user's session token in the Authorization header. This allows your backend to securely identify the requesting user and gate API routes based on their authentication status, user ID, and more.

When your server receives a request, the location of the user's session token depends on whether your app uses local storage (the default) or cookies to manage user sessions:

* If using **local storage** to store a user's session, the session token is passed in the Authorization header of the request.
* If using [**cookie sessions**](https://www.openfort.io/docs/configuration/cookie-sessions), the browser sends the `openfort.session_token` cookie on same-site requests. The cookie value is not a bearer token: verify it by forwarding the `Cookie` header, as shown below.

For example, in [NextJS](https://nextjs.org/), you might extract the session token from a `NextApiRequest` as follows:

:::code-group
```ts [Bearer token]
const sessionToken = req.headers.authorization.replace('Bearer ', '');
```

```ts [Cookie session]
const response = await fetch("https://openfort-auth.example.com/api/iam/v2/auth/get-session", {
  headers: {
    cookie: req.headers.cookie ?? "",
    "x-project-key": process.env.OPENFORT_PUBLISHABLE_KEY!,
  },
});
const session = response.ok ? await response.json() : null; // null when there is no valid session
```
:::

## Verify the user's session token

Once you've obtained the user's session token from a request, verify the token against Openfort to confirm that Openfort issued it and the user referenced by the token is authenticated.

Session tokens are signed using HMAC-SHA-256 and verified against Openfort's servers. Use the official Openfort Node SDK to verify tokens:

```ts [Node.js]
import Openfort from "@openfort/openfort-node";
const openfort = new Openfort(process.env.OPENFORT_SK, {
  publishableKey: process.env.OPENFORT_PUBLISHABLE_KEY,
});

const session = await openfort.iam.getSession({ accessToken: "USER_SESSION_TOKEN" });
if (!session) throw new Error("Invalid or expired session");
console.log("User ID:", session.user.id);
console.log("User Email:", session.user.email);
console.log("Session expires:", session.session.expiresAt);
```

The `getSession` method validates the token signature and checks that the session hasn't expired (sessions last 30 days by default with automatic refresh on activity). It resolves to `null` instead of throwing when the token is missing, malformed, or expired, so check the result before reading `user` or `session`.

:::tip[Runnable example]
See the [IAM examples](https://github.com/openfort-xyz/openfort-node/tree/main/examples/iam) in the Node SDK repository, including `getSession`, `getUser`, and `listUsers`.
:::