S
Supabase2mo ago
seno

Legacy api keys used even if disabled?

I have disabled legacy api keys and enabled the new keys. now I call an edge function and I get this error: Authentication error: Legacy API keys are disabled could it be that the edge function secrets have not been updated? because I created the branch then disabled legacy keys import { createClient } from 'npm:@supabase/supabase-js@2'; const corsHeaders = { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type' }; const supabaseServiceRoleKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY'); if (!supabaseUrl || !supabaseAnonKey || !supabaseServiceRoleKey) { console.error('Server configuration error: Missing Supabase environment variables.'); return new Response(JSON.stringify({ error: 'Server configuration error.' }), { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }); } const authHeader = req.headers.get('Authorization'); if (!authHeader) { return new Response(JSON.stringify({ error: 'Missing Authorization header.' }), { status: 401, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }); } const supabase = createClient(supabaseUrl, supabaseAnonKey, { global: { headers: { Authorization: authHeader } } }); const supabaseAdmin = createClient(supabaseUrl, supabaseServiceRoleKey, { auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false } }); console.log("Authenticating user..."); const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(); if (authError || !authUser) { console.error('Authentication error:', authError?.message || 'No user found.'); return new Response(JSON.stringify({ error: 'User not authenticated.'
No description
No description
No description
36 Replies
ibrahim
ibrahim2mo ago
where are you calling the edge function from and have you updated that with the new values and maybe restarted?
seno
senoOP2mo ago
@ibrahim I dont think the issue is with my frontend tbh. this is working in my main branch
No description
garyaustin
garyaustin2mo ago
The secrets only contain the legacy API keys. Did you log out the service_role key? If you look in the Edge Function UI you'll probably still see your old service_role secret there. Which won't work anymore when you call Supabase because you disabled it.
seno
senoOP2mo ago
@garyaustin not sure what you mean with "edge function ui". in the code there is this " const supabaseServiceRoleKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY');" but shouldnt this be automatically the new key? I have disabled "Verify JWT with legacy secret" and as you can see from my screenshots when making the call I use the new Publishable key as apikey
No description
garyaustin
garyaustin2mo ago
No description
garyaustin
garyaustin2mo ago
I have legacy API keys disabled. The secrets are still the old JWT keys.
seno
senoOP2mo ago
hmm ok that is what I suspected. but why is this workign in main branch and how can I make it work with the new keys?
garyaustin
garyaustin2mo ago
I've not seen an answer for passing in the SB style secrets automatically.
You could certainly add the secret to your own named secret and paste it in.
garyaustin
garyaustin2mo ago
Similar question from another user.
No description
garyaustin
garyaustin2mo ago
Or not disable them for now.
seno
senoOP2mo ago
sooo there's really no solution other than creating a secret with another name and replacing this in all edge functions? this is super strange because in a branch that I deleted and in the main branch they work perfectly
garyaustin
garyaustin2mo ago
Do you have Legacy disabled in the main branch? You can use the new keys and old keys together.
seno
senoOP2mo ago
yep it is the completely same implementation
No description
garyaustin
garyaustin2mo ago
What does your Edge function UI show for the secrets?
seno
senoOP2mo ago
No description
garyaustin
garyaustin2mo ago
So they will be pulled as the old secrets in that branch.
seno
senoOP2mo ago
ok I understand but why was this working before and this basically works in the main branch? this is really sth strange... I am pretty sure it was working with this configuration in my deleted branch and it works in my main branch which is basically the same as this new branch
garyaustin
garyaustin2mo ago
Sorry. Console.log the secret in your edge function. I forgot those are encoded. But I don't believe they change to the new secrets.
seno
senoOP2mo ago
no I dont think they changed. but they somehow did in main
garyaustin
garyaustin2mo ago
I'm wrong. It is working now.
seno
senoOP2mo ago
not sure I understood. what is working now?
garyaustin
garyaustin2mo ago
The secret is updated to the SB... key in the edge function secrets. At least with Legacy Disabled.
seno
senoOP2mo ago
sooo why is my old key still being used then?
No description
No description
garyaustin
garyaustin2mo ago
Did you console.log in the function and for sure they are the old JWT keys? Also you are setting the Authorization header to the incoming Authorization header. Is that a user JWT?
seno
senoOP2mo ago
from the logs I can see that the service role and anon keys are the new keys (not the legacy ones)
seno
senoOP2mo ago
No description
garyaustin
garyaustin2mo ago
That is your call to the Edge function headers?
seno
senoOP2mo ago
yes
garyaustin
garyaustin2mo ago
And by logs you mean you logged out the secrets in the Edge function? I'd double check the authorization header coming in is not the old anon key.
seno
senoOP2mo ago
No description
garyaustin
garyaustin2mo ago
What does the JWT decode to for auth? It looks like it should be a user JWT from the cookie. But if for some reason it is legacy anon/service that would probably cause the same error as the apikey header being wrong.
seno
senoOP2mo ago
yes it is the access_token from the cookies it looks pretty much like the legacy anon key but the ending is different. so sthi like this with the ending obviously eyJhbGciOiJFUzI1NiIsImtpZCI6IjQ2MjVkZjM1LTM3OGQtNDRmNy05MTA3LTk0OTE4OWZiOGFkYiIsInR5cCI6IkpXVCJ9
garyaustin
garyaustin2mo ago
Dump it in jwt.io If it is anon then that is your issue. If it is much longer then probably a user jwt which should be fine.
seno
senoOP2mo ago
{ "iss": "url/auth/v1", "sub": "74688c29-778a-4272-b21e-b876a508b177", "aud": "authenticated", "exp": 1762290706, "iat": 1762287106, "email": "sb+real1@a.co", "phone": "", "app_metadata": { "provider": "email", "providers": [ "email" ] }, "user_metadata": { "email": "sb@a.co", "email_verified": true, "phone_verified": false, "sub": "74688c29-778a-4272-b21e-b876a508b177" }, "role": "authenticated", "aal": "aal1", "amr": [ { "method": "password", "timestamp": 1762276990 } ], "session_id": "5f796c61-b2c4-4bf2-8e00-eb46697a9c9b", "is_anonymous": false } oops it's working now. I'm pretty sure I changed nothing. all other edge functions working too. very strange
garyaustin
garyaustin2mo ago
Well. At least I know now they fixed the SB_secret stuff. Sorry for that digression.
seno
senoOP2mo ago
many thanks 👍

Did you find this page helpful?