BREAKING: Supabase JWT Authentication Issues - 401 Errors Affecting Services

Supabase experiencing widespread 401 errors due to JWT rejection. Immediate workarounds and status checks included.

INCIDENT SUMMARY

Supabase is currently experiencing authentication failures with JWT token rejections resulting in 401 errors across services. This affects applications relying on Supabase for authentication and API access.

WHAT IS DOWN

Primary Impact: JWT-based authentication layer

Affected Services: API calls requiring valid JWT tokens, authenticated database queries, realtime subscriptions requiring auth

User Impact: Applications cannot authenticate users; API requests return 401 Unauthorized

Scope: Appears to be widespread, affecting multiple Supabase projects

IMMEDIATE WORKAROUNDS

1. Temporary Public/Anonymous Access (if applicable)

Switch non-sensitive queries to anonymous/public Row Level Security (RLS) policies

Update RLS policies to allow anonymous access temporarily

Limitation: Only suitable for non-sensitive data

2. JWT Token Validation Bypass (development only)

Temporarily disable strict JWT validation if running self-hosted or with custom auth

Implement local token validation as fallback

Note: This is NOT recommended for production

3. Switch to Alternative Auth Methods

Use API key authentication (if configured)

Implement session-based auth with custom tokens

I'm unsure if Supabase currently supports simple API key auth as primary method

4. Redirect to Alternative Services

Firebase Authentication (for auth layer)

Auth0 (managed auth service)

AWS Cognito (for authentication)

Your own authentication server

HOW TO CHECK IF YOU'RE AFFECTED

Quick Test: ```bash curl -H "Authorization: Bearer YOUR_JWT_TOKEN" \ https://your-project.supabase.co/rest/v1/your_table \ -H "apikey: YOUR_ANON_KEY" ```

Symptoms:

API responses with {"code":"PGRST301","message":"401 Unauthorized"}

Auth redirects failing

Realtime subscriptions disconnecting

Supabase dashboard may or may not be accessible

Status Check:

Visit Supabase status page (status.supabase.com)

Check [Supabase GitHub issues](https://github.com/supabase/supabase/issues)

Monitor official Twitter/X @supabase account

ALTERNATIVES & MITIGATION

Short Term (Next Hours)

Use public RLS policies for essential operations

Queue requests and retry with exponential backoff

Display maintenance message to users

Medium Term (Hours to Days)

Migrate critical auth to external provider

Implement local JWT validation caching

Set up fallback authentication service

Long Term

I'm unsure of root cause - awaiting official statement from Supabase

Implement multi-auth-provider strategy

Add comprehensive auth layer redundancy

NEXT STEPS

1. Monitor: Refresh status.supabase.com every 5-10 minutes 2. Communicate: Notify users of service degradation 3. Implement: Deploy workaround matching your use case 4. Prepare: Have alternative auth ready if outage extends beyond 1 hour

STATUS

⚠️ ONGOING - Last updated: NOW

*Note: This report contains technical recommendations based on typical JWT/auth failure patterns. Specific details from Supabase engineering team pending.*