product · inferred from evidence

JWT

A JSON Web Token used for session authentication.

PGRST303 "JWT issued at future" on REST requests using the new sb_secret_ key
After moving to the new non-JWT sb_secret_ key format, REST calls authenticated with the service-role key intermittently return 401 with proxy_status PostgREST and error PGRST303 ("JWT issued at future"). The odd part: the client only ever
supporting2026-09-23 01:13 UTC
When to use supabase.auth.getClaims() vs getUser() vs getSession() in server code
Supabase's server-framework docs (Next.js middleware, SvelteKit hooks, etc.) defaulted to supabase.auth.getUser() and getSession(), and it was unclear when to use supabase.auth.getClaims() instead. getUser() adds an extra call to the auth s
supporting2026-09-23 01:13 UTC
"new row violates row-level security policy" (42501) on INSERT with TO anon WITH CHECK (true)
A public contact/lead form needs anonymous users to insert rows into a table, so RLS was enabled with CREATE POLICY ... FOR INSERT TO anon WITH CHECK (true) plus GRANT INSERT ON the table TO anon and GRANT USAGE, SELECT ON SEQUENCE TO anon.
supporting2026-09-23 01:13 UTC

Skills in this topic

Supabase PGRST301 JWT invalid: the anon key and service role key are not interchangeable
Fix for Supabase PGRST301 JWT invalid: the anon key and service role key are not interchangeable: After any key rotation in the dashboard, update every consumer: frontend env, Edge Function secrets, server env, CI. Use this when you hit exa
Python + Supabase: verify server-side with auth.get_user, one client per process
Guide Python + Supabase: verify server-side with auth.get_user, one client per process: Create the client with # Python + Supabase: server-side verification discipline supabase-py runs on your server, but agents write it as if the client se
Next.js SSR: intermittent JWT token expired errors
Shows how to fix next.js SSR: intermittent JWT token expired errors. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
Supabase Realtime 403 on private channels: the channel is authorized, the name is not
Fix for Supabase Realtime 403 on private channels: the channel is authorized, the name is not: Agents rename the channel, add prefixes, and retry. # Realtime 403: authorization failed, not a channel typo A channel that 403s on subscribe (or
Supabase JWT expired on long sessions: refresh before you verify, not after you fail
Shows how to fix supabase JWT expired on long sessions: refresh before you verify, not after you fail. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
Iterable Android SDK silent failures: auth race and missing handler
When Iterable Android SDK calls silently do nothing, look for auth ordering bugs before retrying. Use this skill when the task matches the title above. Not for unrelated tools or errors; check the tool's own docs for those.