S

Supabase•5mo ago

Hugo

invalid api key

Auth Failure in Production (401 "Invalid API Key") – Need Help

Hi team, I'm running into a critical authentication failure with Supabase on my production deployment (Netlify). Hoping someone can help or escalate:

Problem Summary
Localhost (localhost:3000) — Auth works perfectly
Production (*.netlify.app) — Fails on sign-in with 401 Unauthorized (Invalid API Key)
Consistently reproducible across all users and devices

Key Observations
-The anon API key works for DB queries (e.g., fetching profiles).
-Only the Supabase Auth service is returning 401 on /auth/v1/token?grant_type=password.
-Environment variables are correct — VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY match the dashboard and load in production.
-Netlify is correctly routing — UI loads, but auth API fails.
-Multiple auth flows fail — PKCE and password-based login both return 401.
-Have not tried rotating JWT signing key — doing so would break critical edge functions, so I’m holding off.
-Support ticket already submitted — I'm a paid Pro user and awaiting a reply from the Supabase team.

What I’ve Tried (but didn’t fix it)
-Vite config tweaks
-Netlify redirect rules
-Circular dependency fixes
-UI cleanup
-RLS policy adjustments
-Bypassing custom edge functions
-Full project restart
(Details omitted here, but happy to provide full audit if needed.)

Suspected Root Cause
Could this be tied to a bug related to the JWT signing key update? I suspect the Auth microservice is misconfigured or rejecting valid anon keys for grant_type=password flows — despite the same key working for DB operations.

Ask
Can someone from the Supabase team please:
-Confirm if this could be infra-related?
-Help validate whether a migration or auth service reset is needed?
-Suggest any other safe debugging steps (short of rotating the JWT signing key)?

We’re completely blocked in production. Grateful for any guidance — happy to DM logs or network traces if helpful.

Thanks in advance!