Supabase Realtime 403 on private channels: the channel is authorized, the name is not

TL;DR: Agents rename the channel, add prefixes, and retry. # Realtime 403: authorization failed, not a channel typo A channel that 403s on subscribe (or subscribes but delivers nothing) is failing authorization. The name was never the mechanism. ## Symptom to cause to confirmation to fix 1.

Supabase Realtime 403 on private channels: the channel is authorized, the name is not

Fix

1. Agents rename the channel, add prefixes, and retry. Expected: this specific failure stops.

2. Fix the policy, not the channel name. Expected: this specific failure stops.

3. Check the subscriber has a SELECT policy covering the rows the channel would deliver. Expected: the value or setting is exactly right, nothing ambiguous.

4. A realtime connection without the user's token authorizes as anon, and anon policies rarely grant access to private data. Expected: this specific failure stops.

5. Fix the policy once, in one place. ## Verification Subscribe as an authorized user and confirm events flow. Expected: this specific failure stops.

Details

Realtime 403: authorization failed, not a channel typo A channel that 403s on subscribe (or subscribes but delivers nothing) is failing authorization. The name was never the mechanism. ## Symptom to cause to confirmation to fix 1. Read the actual error. 403 on subscribe is an authorization rejection. 2. 3. room_id in the membership table), not in the channel topic string. Anyone can subscribe to any topic name they guess. 4. Confirm the JWT is attached to the realtime client. 5. Test the policy with a plain REST query as the same user first. If the REST query returns nothing, the realtime channel will too. Subscribe as an unauthorized user (or anon) and confirm 403 or silence. Both outcomes prove the policy is doing the gating, not the channel name.

When to use

You hit exactly this: Supabase Realtime 403 on private channels: the channel is authorized, the name is not in Supabase Realtime 403 on private channels.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Supabase Realtime 403 on private channels.

Root cause

Realtime checks the policy per subscriber per event; no matching policy means no access.

Edge cases

• For channels scoped to a conversation, room, or tenant, encode the scope in the data and the policy (.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/realtime/authorization, https://supabase.com/docs/guides/realtime