← All errors · Supabase

Invalid JWT / JWT expired

Exact error

AuthApiError: invalid JWT: unable to parse or verify signature, token is expired

What it means

The access token sent to Supabase is expired or was signed with a different project's secret.

Likely causes

• Session not refreshed (e.g. server code reading a stale cookie).
• Mixing URL/keys from two different Supabase projects.
• Rotated JWT secret / API keys.

How to fix it

1. Verify NEXT_PUBLIC_SUPABASE_URL and the anon key come from the same project (Dashboard → Project Settings → API).

2. In Next.js, use @supabase/ssr and refresh the session in middleware as shown in Supabase's Next.js server-side auth guide.

3. Sign out and back in to obtain a fresh token after rotating keys.

Related errors

• supabaseUrl is required
• new row violates row-level security policy for table