all other controllers:

	public function behaviors(): array
	{
		$behaviors = parent::behaviors();
		
		$behaviors['authenticator']['except'] = array_merge(
			$behaviors['authenticator']['except'], [
				'csrf-token',
				'refresh-jwt-token',// TODO - Not sure about this
			]
		);
		
		// Add 'options' HTTP verb to skip auth for CORS preflight
		$behaviors['authenticator']['except'][] = 'options';
		
		// Remove duplicates just in case
		$behaviors['authenticator']['except'] = array_unique(
			$behaviors['authenticator']['except']
		);
		
		return $behaviors;
	}
	

class ApiBaseController extends Controller
{
	public function behaviors(): arra
	{
		$behaviors = parent::behaviors();
		
		$behaviors['authenticator'] =
		[
			'class' => CompositeAuth::class,
			
		$behaviors['corsFilter'] =
		[
			'class' => Cors::class,
			'cors' => [
				// Allowed request origins - set via env variable or fallback default
				'Origin' => $this->getAllowedOrigins(),
				
				/**
				* Allowed HTTP methods in CORS preflight
				* Can be overridden in child controllers to narrow methods per controller
				*
				* If left empty or not set here, 'Cors' defaults to all common HTTP verbs allowed.
				*
				'Access-Control-Request-Method' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],//*/
				
				/**
				* Allowed HTTP headers clients can use during the actual requests.
				* This should include Authorization for bearer tokens and other headers you expect.
				*
				* Common headers your React app will send are:
				* - Authorization (for Bearer token)
				* -- Your backend CORS must allow both 'Authorization' and 'Content-Type' in Access-Control-Allow-Headers.
				* -- Also, 'OPTIONS' requests must bypass authentication for CORS 
				*    preflight (see 'except' => ['options'] in authenticator behavior).
				* - Content-Type (usually application/json)
				* - X-Requested-With (sometimes added by libraries)
				* - X-CSRF-Token (if using CSRF protection, mostly for stateful apps)
				* - Accept (To ask API which format it supports) Often handled automatically, usually no CORS action needed
				*
				* Note: For native apps or SPAs that send JWT tokens via the Authorization: Bearer <token> header in AJAX/fetch requests, 
				* this header must be allowed by CORS to avoid preflight errors by the browser.
				*/
				'Access-Control-Allow-Headers' => ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
				'Access-Control-Expose-Headers' => ['X-CSRF-Token'],
				
				// Allow credentials (cookies, HTTP auth, etc.) in requests
				'Access-Control-Allow-Credentials' => true,
				
				// Preflight OPTIONS request cache duration (seconds)
				'Access-Control-Max-Age' => 3600,
			],
		];
		
		$behaviors['contentNegotiator'] =
		[
			'class' => ContentNegotiator::class,
			'formats' => [
				'application/json' => Response::FORMAT_JSON,
			],
		];
		
		$behaviors['authenticator'] =
		[
			'class' => CompositeAuth::class,
			/**
			* Except
			* - Skips auth on all OPTIONS requests
			* - Allows unauthenticated access to these actions
			*
			'except' => ['options'],//*/
			
			'authMethods' => [
				CookieJwtAuth::class,// Cookie based for browsers - Check 'access_token' cookie
				/**
				* For cross-platform frameworks (React Native) or native apps, you’ll need to:
				* Store the tokens in secure storage modules (e.g., react-native-keychain or SecureStore).
				* Manually attach the access token in the Authorization header with every API request:
				*
				*	headers: {
				*		Authorization: `Bearer ${token}`,
				*		// other headers
				*	}
				*
				* On token expiry, call your refresh endpoint and update stored tokens accordingly.
				*/
				HttpBearerAuth::class,// Header based for native app/api clients//*/
			],
		];
		
		return $behaviors;
	}
}

so im getting a error now of:

PHP Warning – yii\base\ErrorException Undefined array key "except"

is it becaused i commented out "'except' => ['options']," from authenticator, since I figured I was calling it in all other controllers with:


$behaviors['authenticator']['except'][] = 'options';