Errors after migrating supabase db (Clerk auth integration issues)

I'm currently resuming a project I worked on a year ago. Since the project was inactive for over 90 days, I migrated the DB to a new project. However, after I migrated the DB, I'm receiving this error:
Error in SELECT operation: {
code: 'PGRST301',
details: null,
hint: null,
message: 'No suitable key or wrong key type'
}
Error in SELECT operation: {
code: 'PGRST301',
details: null,
hint: null,
message: 'No suitable key or wrong key type'
}
I'm not sure if this is an issue with clerk + supabase integration because I read that there's a new way to integrate clerk into supabase. I tried changing the RLS according to https://clerk.com/docs/integrations/databases/supabase but it still gives me the same error. Can someone please help me with this? I'm not sure what might be causing this error.
Integrations: Integrate Supabase with Clerk
Learn how to integrate Clerk into your Supabase application.
68 Replies
YouLL
YouLL2w ago
I'm having the same exact issue Even with RLS disabled the same issue appears
YouLL
YouLL2w ago
https://github.com/PostgREST/postgrest/issues/4048 Based on this, looks like the system can't find the correct key to decode the jwt token
GitHub
v13: JWT and JWK key ids must match · Issue #4048 · PostgREST/pos...
Environment PostgreSQL version: 13.3 PostgREST version: latest / devel Operating system: Docker Description of issue Currently using latest images with this JWT Secret Config: { "alg":&qu...
garyaustin
garyaustin2w ago
I've seen something somewhere about the kid claim in relation to issues after the new asymmetric JWT where added . I don't remember if the old method of doing Clerk tie had that set or not.
garyaustin
garyaustin2w ago
JSON Web Token (JWT) | Supabase Docs
Information on how best to use JSON Web Tokens with Supabase
YouLL
YouLL2w ago
I'm using the accessToken property in the createClient as the docs says The returned token contains the kid claim But it's not getting validated somehow
garyaustin
garyaustin2w ago
I'm not going to be much help. And to clarify this is with the older method versus the integrated Clerk method now suggested. Odd two of you suddenly have issues if this was working before. The asymmetric stuff was added months ago to the infrastructure.
YouLL
YouLL2w ago
Actually this is the first time I implemented Clerk in my project and this issue was there since the first time. I just followed what the docs says, so I assume I followed the new approach
garyaustin
garyaustin2w ago
Supabase
Clerk | Works With Supabase
Authentication for Next.js, React, and the Modern Web.
YouLL
YouLL2w ago
I didn't follow the above because I read this:
This integration is being deprecated on 1 April 2025, and replaced with the new Clerk third-party integration. See the Supabase with Clerk docs for more information. You can still use this integration unofficially since the primitives on both the Supabase and Clerk sides remain functional. Limited support will be provided.
garyaustin
garyaustin2w ago
Right. It just had a link to the new integration method. There are a few Clerk users here but the OP's title does not mention Clerk so not sure they will notice. Seems like the OP was using the old method and you said you had the same issue. So just clarifying.
YouLL
YouLL2w ago
Ok but at this point the issue happens for both integration method, always if the OP was using the old one @BackTo1964Brazil Whenever you can, can you please update the title to include Clerk? So we might get some help from Clerk's users
BackTo1964Brazil
BackTo1964BrazilOP2w ago
yup
YouLL
YouLL2w ago
Thanks!
garyaustin
garyaustin2w ago
Can you check what version of PostgREST you are on? Infrastructure tab in settings.
YouLL
YouLL2w ago
I'm with the local setup of supabase From where can I check it there?
garyaustin
garyaustin2w ago
No idea. I don't use that. I think it would be based on your CLI version.
YouLL
YouLL2w ago
I'm on v2.34.3 CLI version
garyaustin
garyaustin2w ago
I'm seeing this error on the web associated with PostgREST 13 which Supabase went to in the past month or so. That is what your link pointed to.
YouLL
YouLL2w ago
PostgreSQL 17.4 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 13.2.0, 64-bit From select version()
garyaustin
garyaustin2w ago
That is not PostgREST but my guess is it is already in the latest CLIs
YouLL
YouLL2w ago
I'll try to update the CLI since I see there's an update
garyaustin
garyaustin2w ago
The detail of the error is in your PostgREST link, but I've not been able to sort how you resolve it. You might need to file an issue in supabase/supabase github issues. @BackTo1964Brazil can you confirm you are on PostgREST 13.x?
BackTo1964Brazil
BackTo1964BrazilOP2w ago
lemme check yes it's on postgrest 13.0.4
garyaustin
garyaustin2w ago
So my GUESS is you two are the first using 13.x with Clerk. It was a very recent change for Supabase to add it.
YouLL
YouLL2w ago
Updating the CLI seems to have fixed the issue for me
BackTo1964Brazil
BackTo1964BrazilOP2w ago
im using the cloud version
garyaustin
garyaustin2w ago
Do you have an upgrade available under infrastructure?
BackTo1964Brazil
BackTo1964BrazilOP2w ago
i dont see it
garyaustin
garyaustin2w ago
Does it say latest
BackTo1964Brazil
BackTo1964BrazilOP2w ago
No description
garyaustin
garyaustin2w ago
No description
BackTo1964Brazil
BackTo1964BrazilOP2w ago
ye
garyaustin
garyaustin2w ago
Support or generate an issue.
BackTo1964Brazil
BackTo1964BrazilOP2w ago
sorry wdym?
garyaustin
garyaustin2w ago
Contact support or generate an issue in supabase/supabase github.
BackTo1964Brazil
BackTo1964BrazilOP2w ago
ok thanks
YouLL
YouLL2w ago
schema: user_id text not null default auth.jwt()->>'sub' RLS policy:
No description
YouLL
YouLL2w ago
With this settings it works for me
BackTo1964Brazil
BackTo1964BrazilOP2w ago
oo let me try this thanks what if u want to access a specific row and to do that u want to compare the user_id with (auth.jwt() ->> 'sub'::text))
YouLL
YouLL2w ago
create policy "Users can view own data" on public.api_sets
for select to authenticated
using (((select auth.jwt()->>'sub') = (user_id)::text));
create policy "Users can view own data" on public.api_sets
for select to authenticated
using (((select auth.jwt()->>'sub') = (user_id)::text));
Like this?
BackTo1964Brazil
BackTo1964BrazilOP2w ago
oh this works? I currently have (( SELECT (auth.jwt() ->> 'sub'::text)) = user_id) which doesn't work
YouLL
YouLL2w ago
Just tested and it does work
BackTo1964Brazil
BackTo1964BrazilOP2w ago
ok thanks
YouLL
YouLL2w ago
But are you having that error on select or insert?
BackTo1964Brazil
BackTo1964BrazilOP2w ago
select actually both
YouLL
YouLL2w ago
create policy "Users can insert own api_sets" on public.api_sets
as permissive
for insert to authenticated
with check (
((select auth.jwt()->>'sub') = (user_id)::text)
);
create policy "Users can insert own api_sets" on public.api_sets
as permissive
for insert to authenticated
with check (
((select auth.jwt()->>'sub') = (user_id)::text)
);
THis for Insert
BackTo1964Brazil
BackTo1964BrazilOP2w ago
ok ty hmmm im still getting an error unfortunately
YouLL
YouLL2w ago
The same one?
BackTo1964Brazil
BackTo1964BrazilOP2w ago
ye
YouLL
YouLL2w ago
Maybe try to restart the project if you have updated it recently
BackTo1964Brazil
BackTo1964BrazilOP2w ago
im not using the sql editor in supabase im using the UI editor and it seems to automatically update it to (( SELECT (auth.jwt() ->> 'sub'::text)) = user_id) which is the same as what i was doing before
YouLL
YouLL2w ago
That's okay, it translated to that for me aswell
BackTo1964Brazil
BackTo1964BrazilOP2w ago
ok so it might not be an issue with the policy
garyaustin
garyaustin2w ago
The original error should have nothing to do with the policy based on the link to PostgREST.
BackTo1964Brazil
BackTo1964BrazilOP2w ago
so is it likely an issue with the new postgrest version that's incompatible with clerk?
garyaustin
garyaustin2w ago
Not Clerk per se but something with needing specific things with KID that I don't understand reading thru it. BUT YouLL upgrading the CLI to latest seems to point away from the latest version being the issue.....
BackTo1964Brazil
BackTo1964BrazilOP2w ago
oh ok
garyaustin
garyaustin2w ago
Last CLI change bumped PostgREST to the same as hosted.
No description
BackTo1964Brazil
BackTo1964BrazilOP2w ago
Could it be an issue with my code? This was my old code that worked before
const supabaseClientWithAuth = async (accessToken: string | null) => {
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_KEY!,
{
global: {
headers: {
Authorization: `Bearer ${accessToken}`,
},
},
},
);

return supabase;
};
const supabaseClientWithAuth = async (accessToken: string | null) => {
const supabase = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_KEY!,
{
global: {
headers: {
Authorization: `Bearer ${accessToken}`,
},
},
},
);

return supabase;
};
but the docs suggests:
import { auth } from '@clerk/nextjs/server'
import { createClient } from '@supabase/supabase-js'

export function createServerSupabaseClient() {
return createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_KEY!,
{
async accessToken() {
return (await auth()).getToken()
},
},
)
}
import { auth } from '@clerk/nextjs/server'
import { createClient } from '@supabase/supabase-js'

export function createServerSupabaseClient() {
return createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_KEY!,
{
async accessToken() {
return (await auth()).getToken()
},
},
)
}
I'm using this:
import { auth } from "@clerk/nextjs/server";
import { NextResponse } from "next/server";

import { supabaseClientWithAuth } from "@/lib/supabase/supabaseClient";

export async function GET(
request: Request,
{ params }: { params: { problemId: string } },
) {
try {
const { userId, getToken } = auth();

if (!userId) {
return new Response("Unauthorized", { status: 401 });
}

const token = await getToken({ template: "supabase" });
const supabase = await supabaseClientWithAuth(token);
import { auth } from "@clerk/nextjs/server";
import { NextResponse } from "next/server";

import { supabaseClientWithAuth } from "@/lib/supabase/supabaseClient";

export async function GET(
request: Request,
{ params }: { params: { problemId: string } },
) {
try {
const { userId, getToken } = auth();

if (!userId) {
return new Response("Unauthorized", { status: 401 });
}

const token = await getToken({ template: "supabase" });
const supabase = await supabaseClientWithAuth(token);
garyaustin
garyaustin2w ago
You are using the old method?
BackTo1964Brazil
BackTo1964BrazilOP2w ago
in my code i started to use the clerk third party integration in the supabase cloud dashboard for auth
BackTo1964Brazil
BackTo1964BrazilOP2w ago
i havent updated supabase js or clerk in my ts project
BackTo1964Brazil
BackTo1964BrazilOP2w ago
Integrations: Integrate Supabase with Clerk
Learn how to integrate Clerk into your Supabase application.
garyaustin
garyaustin2w ago
I don't use Clerk so I'm just going on stuff I've seen users do here. Your error is associated with that PostgREST issue and Supabase just changed to that version. That is why I suspected that. But I have no way to know and after reading that issue still don't fully understand it.
BackTo1964Brazil
BackTo1964BrazilOP2w ago
oh ok ty for ur help
garyaustin
garyaustin2w ago
Are you using the new JWT methods? Not sure how the guide/integration works with them.
No description
BackTo1964Brazil
BackTo1964BrazilOP2w ago
i followed steps 1 and 2 in the guide https://clerk.com/docs/integrations/databases/supabase. im still using legacy jwt secret the issue is fixed after i updated to the latest clerk and supabase versions

Did you find this page helpful?