← All errors · SupabaseSupabase auth errors
Invalid JWT / JWT expired
Exact error
AuthApiError: invalid JWT: unable to parse or verify signature, token is expired
What it means
The access token sent to Supabase is expired or was signed with a different project's secret.
Likely causes
- Session not refreshed (e.g. server code reading a stale cookie).
- Mixing URL/keys from two different Supabase projects.
- Rotated JWT secret / API keys.
How to fix it
Verify NEXT_PUBLIC_SUPABASE_URL and the anon key come from the same project (Dashboard → Project Settings → API).
In Next.js, use @supabase/ssr and refresh the session in middleware as shown in Supabase's Next.js server-side auth guide.
Sign out and back in to obtain a fresh token after rotating keys.
Prevent this next time
- Configure custom SMTP before launch so auth emails are not limited by the built-in test sender.
- Test signup, login, password reset and email confirmation on a staging project after every auth change.
FAQ
What does "Invalid JWT / JWT expired" mean?
The access token sent to Supabase is expired or was signed with a different project's secret.
What usually causes it?
Session not refreshed (e.g. server code reading a stale cookie). Mixing URL/keys from two different Supabase projects. Rotated JWT secret / API keys.
How do I fix it?
1. Verify NEXT_PUBLIC_SUPABASE_URL and the anon key come from the same project (Dashboard → Project Settings → API). 2. In Next.js, use @supabase/ssr and refresh the session in middleware as shown in Supabase's Next.js server-side auth guide. 3. Sign out and back in to obtain a fresh token after rotating keys.
Related errors
Get new fixes weekly
No spam. Unsubscribe anytime. Privacy