Are you using Arc, it isn't supported anymore so it could be the issue, also you should check the "Request Headers" field in Xano's Request History Details, as authorization is passed in header of the request.
Make sure to include the Expires in in auth/login's Set Session Cookies, as Toddle can't receive it from Xano's access key. That was an issue in toddle for a couple of weeks but they should've solved it, you could try to test in on a preview page to see if it's an error with Toddle's editor