Finally, Yeah you are right I have set up postman so that once the user logs in the bearer token get reflected in all the route whenever. I was making request to public endpoint the logged in user’s JWT was getting attached to it and I was getting forbidden error