BREAKING: Supabase MINOR 🔴 S3 endpoints with special characters broken [5cbt09m9y46n]

Supabase S3 storage endpoints failing for keys containing special characters. Immediate workarounds and monitoring steps for indie hackers.

BREAKING: Supabase S3 Endpoint Issue – Special Character Keys

Status: Identified | Severity: Minor | Impact: Partial | Updated: Just now

---

What's Down & Who's Affected

Supabase is currently experiencing issues with S3 storage endpoints when object keys contain special characters (spaces, brackets, ampersands, etc.).

Who this affects:

Projects using Supabase Storage with object keys containing: %, &, #, ?, spaces, or URL-unsafe characters

Direct S3 endpoint access (signed URLs may fail)

Batch operations on affected keys

Who's NOT affected:

Keys using only alphanumeric characters, hyphens, underscores, periods

Supabase dashboard file operations (unaffected)

Database layer (completely unaffected)

Authentication/Auth endpoints

---

Immediate Workarounds – Do This NOW

Option 1: Rename Object Keys (Fastest)

Re-upload files with sanitized names: ```javascript const sanitizeKey = (filename) => { return filename .replace(/[^a-z0-9.-]/gi, '-') .toLowerCase(); };

// Example: "My Document (2024).pdf" → "my-document-2024.pdf" ```

Option 2: URL Encode Before Requests

Explicitly encode keys when generating signed URLs: ```javascript const signedUrl = supabase.storage .from('bucket') .getPublicUrl(encodeURIComponent(keyWithSpecialChars)); ```

Option 3: Use Base64-Encoded Keys

Store metadata with original filename, reference by Base64: ```javascript const encoded = Buffer.from(filename).toString('base64'); // Store: {original: "My File.pdf", key: "TXkgRmlsZS5wZGY="} ```

Option 4: Temporary S3 Bypass

If critical, use AWS S3 directly during incident (requires your own credentials): ```javascript const AWS = require('aws-sdk'); const s3 = new AWS.S3({ accessKeyId: process.env.AWS_ACCESS_KEY, secretAccessKey: process.env.AWS_SECRET_KEY }); // Use until Supabase resolves ```

---

How to Check If Your Project Is Affected

1. Quick Test: - Try uploading a file named test file.txt (note the space) - Attempt to retrieve it via signed URL - If it fails with 404 or signature mismatch → you're affected

2. Check Your Logs: ```bash # Look for 403 Forbidden or 404 Not Found errors # on keys matching pattern: /[%&?#\s]/ ```

3. Query Metadata: ```sql -- Check storage objects with special characters SELECT name FROM storage.objects WHERE name LIKE '%[^a-zA-Z0-9._-]%'; ```

---

Alternative Tools to Consider

If you need immediate alternatives:

Cloudinary – Image/media focused, excellent special char handling

Firebase Storage – Handles special chars natively

Bunny CDN Storage – S3-compatible, robust char support

AWS S3 directly – Full control, no intermediary layer

MinIO (self-hosted) – S3-compatible alternative

---

How to Monitor Recovery

1. Official Status: Check [status.supabase.com](https://status.supabase.com) 2. Join Slack: Monitor #incidents in Supabase community 3. Set Alert: Use this incident ID [5cbt09m9y46n] to track updates 4. Retry Schedule: - First retry: 15 minutes - Second retry: 1 hour - Full recovery typically within 4 hours for Supabase incidents

---

Bottom Line

This is not a data loss issue. Your files are safe. Implement workaround #1 (key sanitization) immediately if you're affected. Expected resolution within 2-4 hours. Update your docs to require alphanumeric keys going forward.

Indie hackers: Comment on the [Supabase GitHub issue](https://github.com/supabase/supabase) if this impacts your launch timeline.