I am using an API to fetch events from DB. The API is protected by using JWT tokens and usually I call the API using fetch with credentials include to have the JWT token included in the call.

Trying to do the same with fullcalendar events but going through the documentation I haven’t seen any option to replicate the behaviour. Since the accessToken cookie is httpOnly I cannot read it from javascript and I need to replicate the behaviour of credentials include provided by fetch. Is it even possible?

My current code is:

    events: {
                url: 'http://localhost:4000/api/timesheet',
                type: 'GET',
                extraParams: {
                    user: sessione.profilo.id,
                    project: sessione.progettoAttivo.id
                },
                error: function () {
                    alert('there was an error while fetching events!');
                },
                color: 'yellow',   // a non-ajax option
                textColor: 'black' // a non-ajax option
            },