@calscks @aniruddh @bashgardev @daolanfler In addition to setting the right headers on your request response per the docs, did you turn on “Include cookies” from the Sandbox Connection Settings modal?
This is what sets the Sandbox to actually set credentials: include as part of the request. I attached some screenshots to find this setting:
