Supabase•2mo ago

Help with custom JWT

Hi team, I'm working on integrating custom third-party JWTs following this guide: https://supabase.com/docs/guides/auth/jwts#using-custom-or-third-party-jwts I'm running into an error when trying to start my local Supabase instance after configuring the signing_keys_path. Steps I've taken: 1. Generated a new signing key:

    npx supabase gen signing-key --algorithm ES256

    npx supabase gen signing-key --algorithm ES256

2. Saved the output (a single JSON object) to signing_key.json. 3. Stopped the local server:

    npx supabase stop --no-backup

    npx supabase stop --no-backup

4. Updated my config.toml to include the new key:

    [auth]
    signing_keys_path = "./signing_key.json"

    [auth]
    signing_keys_path = "./signing_key.json"

5. Tried to start the server again:

    npx supabase start

    npx supabase start

The Error When I run npx supabase start, it fails with this error:

failed to decode signing keys: failed to parse response body: json: cannot unmarshal object into Go value of type []config.JWK
Try rerunning the command with --debug to troubleshoot the error.

failed to decode signing keys: failed to parse response body: json: cannot unmarshal object into Go value of type []config.JWK
Try rerunning the command with --debug to troubleshoot the error.

If I comment out the signing_keys_path line in config.toml and start again, the server starts perfectly fine. My Question The error cannot unmarshal object into Go value of type []config.JWK suggests that Supabase is expecting a JSON array of keys (a []JWK), but the gen signing-key command outputs a single JSON object. My signing_key.json currently looks like this (a single object):

{
  "kty": "EC",
  "crv": "P-256",
  "x": "...",
  "y": "...",
  "d": "..."
}

{
  "kty": "EC",
  "crv": "P-256",
  "x": "...",
  "y": "...",
  "d": "..."
}

Thanks in advance for any help!

16 Replies

Amal ChandranOP•2mo ago

Just to add some more context on my use case: I'm trying to integrate better-auth (specifically their JWT plugin: https://www.better-auth.com/docs/plugins/jwt#usage). The goal is to use better-auth to handle all authentication and then use the JWT it issues to authenticate with Supabase for services like Realtime and Storage. I'm following a similar pattern to the official Clerk integration (https://supabase.com/partners/integrations/clerk), but for this provider. My post above is about the technical blocker I've hit while trying to get the Supabase auth server to recognize the better-auth signing key. Thanks!

JWT | Better Auth

Authenticate users with JWT tokens in services that can't use the session

inder•2mo ago

Hi what is your cli version? Also try starting the stack after editing the json file

[
{key object}
]

[
{key object}
]

Amal ChandranOP•2mo ago

➜ npx supabase --version 2.54.11

inder•2mo ago

Yeah so I tested it. Some issue with this version. It worked fine with v2.53.6. automatically outputted correct json with key inside array. Also after wrapping key with square brackets, everything works.

Amal ChandranOP•2mo ago

Yes you are right its working 🤟

Amal ChandranOP•2mo ago

i have added the role as described in https://supabase.com/docs/guides/auth/jwt-fields but file upload / post create is failing when rls is enabled

JWT Claims Reference | Supabase Docs

Complete reference for claims appearing in JWTs created by Supabase Auth

inder•2mo ago

I'd recommend to create a new post for this. I've never used better-auth before so won't be of any help

Amal ChandranOP•2mo ago

I have found the issue and the clerk example helped me to solve the same https://supabase.com/partners/integrations/clerk

Supabase

Clerk | Works With Supabase

Authentication for Next.js, React, and the Modern Web.

Amal ChandranOP•2mo ago

I was passing publish key insted of the jwt 😌 @inder Thanks for the help im sorted out 🤟

Amal ChandranOP•5w ago

the solution example https://github.com/amal-chandran/supabase-experiments/tree/experiment/better-auth

GitHub

GitHub - amal-chandran/supabase-experiments at experiment/better-auth

This repository is to keep track of all the Supabase experiments. - GitHub - amal-chandran/supabase-experiments at experiment/better-auth

Kalleby Santos•4w ago

Hey @Amal Chandran 💚 Are you able to use this custom oAuth with edge functions? I'm investigating this issue but I don't have exp with oAuth. May you could help me with that?

Amal ChandranOP•4w ago

@Kalleby Santos
The supabase edge functions did not worked for me, Some of the libs are behaving weird errors in deno env Its hard to configure deno & node js to work together ref: https://discord.com/channels/839993398554656828/1437038461143224391/1437046216021119108 I swithed to vercel functions & configured rpc, using this stack - https://www.better-t-stack.dev/new?api=orpc&db=postgres&name=supabase-start&dbs=supabase&pm=npm - https://vercel.com/docs/frameworks/backend/hono

Stack Builder - Better-T-Stack

Interactive Ui to roll your own stack

Hono on Vercel

Deploy Hono applications to Vercel with zero configuration. Learn about observability, ISR, and custom build configurations.

Kalleby Santos•4w ago

Hei Amal, thanks for that At the end we did decided the following conclusion for jwt at edge functions: https://github.com/supabase/supabase/discussions/34988#discussioncomment-14970798 I'm very sorry to read that you couldn't make it with edge functions 💔 Maybe I can help you with a custom provider template for better-auth 😁

GitHub

Clerk & Supabase Third Party Integration: Edge Functions Authentica...

The Issue I am busy upgrading our Clerk integration to the new third-party pattern. Running database queries and mutations works fine, but when accessing Edge Functions (supabase.functions.invoke) ...

Amal ChandranOP•4w ago

more than custom provider issue, it was hard for me to make it work with other node js deps. i wanted a mono repo code structure to share code b/w funcitons and ui which was not possible.

Kalleby Santos•4w ago

it is, do you prefer Nextj or other framework? I saw you may been using tanstack

Gaming

Programming

Help with custom JWT

Did you find this page helpful?