product · inferred from evidence
JWT
A JSON Web Token used for session authentication.
- "new row violates row-level security policy" (42501) on INSERT with TO anon WITH CHECK (true)
Call signInAnonymously() once at app start before the form submits, instead of using a bare anon-key client. That gives the request a real session JWT (an anonymous user with is_anonymous: true) which travels as the authenticated role, so a
- PGRST303 "JWT issued at future" on REST requests using the new sb_secret_ key
This is transient clock drift between Supabase's own backend services, not a client-side bug. With the new opaque key format, the gateway exchanges your sb_secret_ key for a short-lived internal token minted with the gateway node's own cloc
- When to use supabase.auth.getClaims() vs getUser() vs getSession() in server code
Use supabase.auth.getClaims() for fast session validation on the server — it checks local JWT validation (signature and expiration) without contacting the auth server, so use it to protect pages and routes and before interacting with the Da