If you are sending the bearer token then you don't need a session cookie. Session cookies are only for interactive use - for example if you were creating a custom UI.
If you're using openapi-generator, there are a few endpoints which are missing the "security" section from the API spec. You therefore need to add the bearer token to the request manually as openapi-generator won't send it automatically. We will fix this in an upcoming release.
