I am using next.js and next-auth to login users against an API. if the login is successful, an httpOnly cookie is set to the browser. The cookie name is __Secure-next-auth.session-token and this is the value (no worries is fake data):

eyJhbGciOiJIUzUxMiJ9.eyJ0b2tlbiI6ImV5SjBlWEFpT2lKS1YxUWlMQ0poYkdjaU9pSlNVekkxTmlKOS5leUpwWVhRaU9qRTJNelkyTXprMk5EY3NJbVY0Y0NJNk1UWXpOalkwTXpJME55d2ljbTlzWlhNaU9sc2lVazlNUlY5VlUwVlNJbDBzSW5WelpYSnVZVzFsSWpvaVpYSnVZVE01UUhkbFltVnlMbU52YlNKOS5obWZqQ3NBWDFsWHdCMWdUNDlRUFdRWjM4OG52b2pKTlJMaDI1d3RCTVlBSHhQN2RxelpsZWFzTWZSVXZqSmJXVjdRUldYZnRYYUJFOG1pTEE4Y1JsNTVlZUd5bE9MbHhoQVRORTZPNjZLQjdzMXhPczB6Nmg1TXFadnlRa3JhcjFfYnF5WXgzQzBZdXVHWk1NWEFMUDJPS3Q5Sjk2dVdZVF9KT25USzNhRTZEQnpqaWF5OWw2alludExLZkUyQUhKMVgwVE9UcEN3QjBHeFB3d1otVWh0NjU5NEtLZS0yakpkQmhqd185VGJWSUVFaV9SbF8zMDFabmhHdDZZYzN6SE9WNm9WSk4zOTBSTXFrM283cWRONkw0R0JKb1g5NzQ1NkNJLTVFSllJN3ozcXpjVEwtZUNGc3luRkJIZHEzNnF2TFd3aDJpeDVkTy1MVDU1cXE5VlEiLCJpYXQiOjE2MzY2NTcwNjYsImV4cCI6MTYzOTI0OTA2Nn0.QGRPwJSECbFfkvUyn8h-gInELUzGHsxBFrnMAW9zEfqCuHwJRkT1aunqFt7g5aWp6DZrSUHaKvp3OJr-0xwUzw

if I decode this jwt, I get an object where one of the properties is jwt and the value is the token I received from the API.

Can anyone please tell me

• if this is the correct format and
• how can I use it in a fetch call to restricted api endpoints?

At the monent I am just doing a fetch call with this options

    method: 'GET',
    'cors': 'no-cors',
    credentials: 'same-origin'

but no luck the response I get is

 [Symbol(Response internals)]: {
    url: 'https://localhost/countries',
    status: 401,
    statusText: 'Unauthorized',
    headers: Headers { [Symbol(map)]: [Object: null prototype] },
    counter: 0
  }