Why doesn't custom token creation work like it used to?

[alireza-asgharii]

Describe the Bug

I migrated from payload version 3.32.0 to 3.65.0 and in the initial test I realized that authentication by manually creating an access token no longer works and gives a 401 error.
I have previously seen the tutorial on creating and hashing an access token for payload from this article: https://medium.com/@nirjalprajapati/custom-jwt-token-generation-in-payload-cms-a-step-by-step-guide-ccb1546fa8bf

Since payload itself does not provide us with a method for this, please advise what to do.

Link to the code that reproduces this issue

https://github.com/payloadcms/payload

Reproduction Steps

I migrated from payload version 3.32.0 to 3.65.0 and in the initial test I realized that authentication by manually creating an access token no longer works and gives a 401 error.
I have previously seen the tutorial on creating and hashing an access token for payload from this article:

Since payload itself does not provide us with a method for this, please advise what to do.

Which area(s) are affected? (Select all that apply)

area: core

Environment Info

Binaries:
  Node: 22.11.0
  npm: N/A
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  payload: 3.65.0
  next: 15.3.3
  @payloadcms/db-mongodb: 3.65.0
  @payloadcms/graphql: 3.65.0
  @payloadcms/next/utilities: 3.65.0
  @payloadcms/plugin-cloud-storage: 3.65.0
  @payloadcms/plugin-form-builder: 3.65.0
  @payloadcms/richtext-lexical: 3.65.0
  @payloadcms/storage-s3: 3.65.0
  @payloadcms/translations: 3.65.0
  @payloadcms/ui/shared: 3.65.0
  react: 19.1.0
  react-dom: 19.1.0
Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Enterprise
  Available memory (MB): 24395
  Available CPU cores: 4

[DanRibbens]

I would guess that the requirements for token based auth changed when we introduced sessions: #12483 released in v3.44.0

This makes logins more secure but it likely caused issues for the way auth following the blog post that was.

I would encourage the blog author to update the steps involved to include updating the user with the session. In addition to that we might need to expose a new function for authenticating on behalf of another user. Feel free to open a new feature request that would allow the workflow needed.

[DanRibbens]

I'm going to close this for now since I don't see a bug or anything else we can fix at the moment.