Cannot create authenticated Servant client that provides a session cookie

Question

I'm trying to create a Servant client for a basic API with session/cookie authentication; yet, I get a type-check error about a missing BearerAuthNotEnabled instance.

Here ist my API:

import           RIO
import qualified Data.Aeson                    as J
import           Servant                       ( (:>), (:<|>) )
import qualified Servant                       as SV
import qualified Servant.Auth.Server           as AS
import qualified Servant.Client                as SC

-- Contents of the session cookie
data User = User
  { username :: !Text
  , email :: !Text
  } deriving (Eq, Show, Generic)

instance J.ToJSON User
instance J.FromJSON User
instance AS.ToJWT User
instance AS.FromJWT User

-- An endpoint that requires authentication.
type ProtectedEndpoint = "protected" :> SV.Get '[SV.JSON] Text

-- The API with authentication wrapped around the protected endpoint.
type Api = (AS.Auth '[AS.Cookie] User :> ProtectedEndpoint)

And here is my attempt to create a client:

apiProxy :: Proxy Api
apiProxy = Proxy

-- Let Servant generate HTTP clients.
protectedClient :: AC.Token -> SC.ClientM Text
protectedClient = SC.client apiProxy

Upon compilation, I get the following instance error, of which I can't make much sense:

    • No instance for Servant.Auth.Client.Internal.BearerAuthNotEnabled
        arising from a use of ‘SC.client’
    • In the expression: SC.client apiProxy
      In an equation for ‘protectedClient’:
          protectedClient = SC.client apiProxy

Am I configuring the Servant client in the correct to pass along a session cookie?

Update: Adding token authentication (JWT) to the mix resolves the issue. I.e., if I declare the API type as

type Api = (AS.Auth '[AS.Cookie, AS.JWT] User :> ProtectedEndpoint)
-- instead of
-- type Api = (AS.Auth '[AS.Cookie] User :> ProtectedEndpoint)