BREAKING: Supabase JWT Authentication Failures – Immediate Workarounds

Supabase experiencing widespread 401 JWT rejection errors. Critical authentication service impacted. Workarounds and status inside.

Incident Summary

Supabase is currently experiencing authentication failures across its platform, with users reporting 401 Unauthorized errors related to JWT token rejections. This affects API requests, real-time subscriptions, and dashboard access for affected projects.

What's Down

JWT Token Validation: Authentication tokens are being rejected at the API gateway level

API Requests: Any endpoint requiring authentication returning 401 errors

Real-time Connections: WebSocket subscriptions failing due to token validation

Dashboard Access: Some users unable to access project dashboards

Status unclear: Direct impact on database operations vs. auth-layer only (monitoring)

How to Check If You're Affected

1. Test API call: Send authenticated request to your Supabase endpoint ```bash curl -H "Authorization: Bearer YOUR_TOKEN" https://YOUR_PROJECT.supabase.co/rest/v1/ ``` If you receive 401, you're affected.

2. Check dashboard: Attempt login to supabase.com dashboard 3. Monitor real-time: Test Supabase client subscriptions 4. Check status page: https://status.supabase.com

Immediate Workarounds

1. Token Refresh Strategy

Force token refresh in your client application

If using Supabase JS client:

```javascript const { data, error } = await supabase.auth.refreshSession(); ```

Re-authenticate users completely if refresh fails

2. Bypass with Service Role Key (Temporary Only)

Use service_role key for critical operations (if you control the request origin)

⚠️ Security risk – only for backend, never expose client-side

Not recommended for production without additional security layers

3. Implement Retry Logic

Add exponential backoff to failed auth requests

Wait 30-60 seconds before retrying

Most reported incidents resolve within this window

4. Cache Responses (Where Applicable)

Serve cached data while authentication is degraded

Disable real-time sync temporarily

Queue requests for retry when service recovers

Alternative Solutions

Short-term alternatives while Supabase recovers:

Firebase Authentication: Drop-in JWT-compatible alternative

Auth0: Enterprise JWT provider

Your own auth server: If you maintain one

Read-only mode: Serve cached data without authentication

What We Don't Know Yet

Root cause (JWT signing service failure, key rotation issue, or gateway misconfiguration)

Estimated time to resolution

Whether specific projects or all projects affected

If new tokens issued during outage are valid post-recovery

Recommendations

1. Do NOT: Issue new sign-ups or password resets during outage 2. Do: Enable offline-first functionality if available 3. Do: Communicate with your users 4. Do: Monitor Supabase status page actively 5. Do: Implement graceful degradation in your app

Status Updates

Follow real-time updates:

Supabase Status Page: https://status.supabase.com

GitHub Discussions: supabase/supabase

Discord: Supabase community channel

*Last Updated: [Current UTC Time]* *Incident ongoing. Report will be updated as situation develops.*