Hey folks, i'm really stuck, i'm using Nextjs 13 with Pages router, I have simple api route handlers which make CRUD calls to Dynamodb, I'm using next-auth with Auth0 as OAuth provider. I want to protect my api routes. So I do the following

     const session = await getServerSession(req, res, authOptions);

     if (req.method === "OPTIONS") {
          return res.status(200).json("ok");
     }

     if (!session) {
          res.status(401).json({ message: "You must be logged in." });
          return;
     }

When I deploy on Vercel, the session returns null when the user is logged in, i've tried using getToken instead, but that returns null as well, I check the requests and it contains the correct cookies and headers, I've added the NEXTAUTH_SECRET but still the problem persists.

Here is my authOptions

export const authOptions: AuthOptions = {
     secret: process.env.NEXTAUTH_SECRET ?? "",
     session: {
          strategy: "jwt",
     },
     callbacks: {
          signIn: async ({ profile, user }) => {
               return await createNewUser(user, profile);
          },
          session: async ({ session, token }) => {
               // @ts-ignore
               session.userId = token.sub;
               // Send properties to the client, like an access_token from a provider.
               // session.accessToken = token.accessToken;
               return session;
          },
          jwt: ({ token }) => {
               return token;
          },
     },
     providers: [
          Auth0Provider({
               clientId: process.env.AUTH0_CLIENT_ID ?? "",
               clientSecret: process.env.AUTH0_CLIENT_SECRET ?? "",
               issuer: process.env.AUTH0_ISSUER ?? "",
          }),
     ],
};