Supabase · infra · fg-0253
Supabase Edge Function returns 401 Invalid JWT for signed-in users after switching to asymmetric JWT signing keys
{"code":401,"message":"Invalid JWT"} when the client sends a logged-in user's access token
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
The built-in verify_jwt gate only understands legacy HS256 JWTs, so user access tokens signed with the new asymmetric signing keys fail it. Publishable or secret API keys pass the gate for migration compatibility, but passing it does not authenticate the caller.
Fix
Turn off verify_jwt for the function and authenticate inside the handler, for example with getClaims on a client built from the request's Authorization header, or with the @supabase/server SDK.
Apply
# supabase/config.toml [functions.my-function] verify_jwt = false supabase functions deploy my-function --no-verify-jwt
Affects: Supabase projects that rotated to asymmetric JWT signing keys and still rely on the Edge Functions verify_jwt check
Sources
- https://supabase.com/docs/guides/troubleshooting/edge-function-401-error-response
- https://supabase.com/docs/guides/api/api-keys
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp