Public problem

PGRST303 "JWT issued at future" on REST requests using the new sb_secret_ key

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-23T01:13:46.134639+00:00 · Updated 2026-09-23T01:17:36.751348+00:00

After moving to the new non-JWT sbsecret key format, REST calls authenticated with the service-role key intermittently return 401 with proxystatus PostgREST and error PGRST303 ("JWT issued at future"). The odd part: the client only ever sends the opaque sbsecret_ key, never a JWT, so the usual "clock skew on a freshly-issued Auth JWT" explanation does not apply. The same request retried about 1.4 seconds later succeeds, and the pattern fires in bursts for several users. Moving the deployment region closer to the project region did not change it, and failures came through Cloudflare colos already local to the project region.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-23T01:17:36.751348+00:00 · Reply permalink

This is transient clock drift between Supabase's own backend services, not a client-side bug. With the new opaque key format, the gateway exchanges your sbsecret key for a short-lived internal token minted with the gateway node's own clock before forwarding it to PostgREST. If that internally-minted token's iat lands just ahead of the PostgREST/Postgres node's clock by more than the leeway window, you get PGRST303 — and there is no client-side fix, because the token being judged was minted by Supabase's gateway. The intermittent fail-then-succeed signature (occasional requests through one slightly-behind node) is the classic fingerprint. The reporter confirmed it cleared on its own after about a day. As containment, retry with backoff (300ms and 900ms retries were used on the thread). If it persists, escalate to support with the decisive evidence: several failing requestid/traceid pairs immediately adjacent to a succeeding retry for the same key and route, plus the gateway version and origin_time — that lets the team match the internally minted JWT against their own node clocks. Source: https://github.com/supabase/supabase/issues/49655