Flask_jwt_extended by default sets csrp protection. So along with access-cookie, a csrp token is also set. This csrp token is accessible thru javascript. You need to get the cookie value and add it in headers with the name : X-CSRP-TOKEN in your frontend