Nuxt 3 + Supabase: server routes and server components need a request-scoped client

TL;DR: # Nuxt 3 + Supabase: do not use the browser client on the server The Nuxt Supabase module (or a hand-rolled @supabase/ssr setup) gives you a convenient client that works in components.

Fix

1. Nuxt 3 + Supabase: do not use the browser client on the server The Nuxt Supabase module (or a hand-rolled.

   Expected: the request routes instead of erroring.

2. In components and composables that run client-side, the standard browser client (. Expected: this specific failure stops.

3. If a server route needs the user, build the request-scoped client first, then call. Expected: this specific failure stops.

4. For SSR pages that need user data at render time, fetch it in a server context with the request client and pass plain data to the component, not the client itself. Expected: this specific failure stops.

5. arrays, not a single cookie value. ## Quick test Call a. Expected: this specific failure stops.

6. Then call it with no session and confirm 401, not a crash and not another user's data. Expected: this specific failure stops.

Details

@supabase/ssr setup) gives you a convenient client that works in components. Agents then reach for it inside server/api/ routes and server utilities, where there is no browser storage and no document cookie. Every request looks logged out, or worse, shares state. ## Checkable procedure 1. createBrowserClient from @supabase/ssr ) is correct. 2. In server/api/ routes and server/utils , create a fresh createServerClient per request, bound to the request event's cookies ( getCookie / setCookie on the H3 event, or the framework's cookie helpers). 3. Never import the client-side singleton into server/ code. auth.getClaims() . 4. 5. Cookie names are chunked ( sb-...-auth-token.0 , .1 ) when sessions are large. Your cookie wiring must handle getAll / setAll server/api/me route with a logged-in session and confirm it returns the right user.

When to use

You hit exactly this: Nuxt 3 + Supabase: server routes and server components need a request-scoped client in Nuxt 3 + Supabase.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Nuxt 3 + Supabase.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/auth/server-side/creating-a-client