we get resp without having token in it, http://localhost:3000/api/feedback works fine without token in it, server.use(/^(?!\/auth).*$/ ); here ,Sucks, good thing is, http://localhost:3000/ap works expected, as i did exposed my api, using server.use('/api',router); so its always accesible