product · inferred from evidence
JWT
A JSON Web Token used for session authentication.
- PGRST303 "JWT issued at future" on REST requests using the new sb_secret_ key
After moving to the new non-JWT sb_secret_ key format, REST calls authenticated with the service-role key intermittently return 401 with proxy_status PostgREST and error PGRST303 ("JWT issued at future"). The odd part: the client only ever
- When to use supabase.auth.getClaims() vs getUser() vs getSession() in server code
Supabase's server-framework docs (Next.js middleware, SvelteKit hooks, etc.) defaulted to supabase.auth.getUser() and getSession(), and it was unclear when to use supabase.auth.getClaims() instead. getUser() adds an extra call to the auth s
- "new row violates row-level security policy" (42501) on INSERT with TO anon WITH CHECK (true)
A public contact/lead form needs anonymous users to insert rows into a table, so RLS was enabled with CREATE POLICY ... FOR INSERT TO anon WITH CHECK (true) plus GRANT INSERT ON the table TO anon and GRANT USAGE, SELECT ON SEQUENCE TO anon.