Supabase Auth refresh failing with 500: missing destination name scopes in *models.Session

Details:

Project: wbxhnyoxkfakjuzvhfrk

Endpoint: POST /token with grant_type=refresh_token

Error from logs: 500: missing destination name scopes in *models.Session

Impact: Session refresh fails, users are logged out and forced to re-login (OTP).

This looks like a GoTrue / SQLX schema mismatch (column scopes exists in auth.sessions but the Session model doesn’t have a matching field). Can you confirm and apply a fix or migration on your side?

garyaustin•12/4/25, 2:15 PM

You would need to contact support if your auth schema is messed up.

Did you at any point make changes to the schema (you should not be able to now)?

garyaustin•12/4/25, 2:15 PM

You could also try a project restart.

licentiousnessOP•12/4/25, 2:20 PM

Thanks for the help and the good catch!

I double-checked the auth schema just to make sure, and everything looks correct on my side:

auth.sessions does include the scopes column
It’s nullable, and all existing sessions have scopes = NULL
I haven’t made any manual changes to the auth schema (and I don’t think I even can now)
All migrations in auth.schema_migrations are up to date

Given that, the error I’m seeing in the logs is:
500: missing destination name scopes in *models.Session

This seems to happen during a refresh token request:
POST /token (grant_type=refresh_token)

So it looks like GoTrue is trying to load a session row, but the internal Session struct doesn’t have a field for scopes, which triggers the SQLX “missing destination name” error.

If you have any ideas on what might be causing that, or whether it points to a version mismatch on the backend, I’d really appreciate it. Otherwise, I can escalate it to Support.

Thanks again for taking the time to help!

garyaustin•12/4/25, 2:22 PM

Restart the project and see if that syncs the auth version. There is no control you have over that.

Do you have an auth schema trigger?

licentiousnessOP•12/4/25, 2:23 PM

Ah, you know what - I upgraded postgres today - wonder if that's it...

licentiousnessOP•12/4/25, 2:28 PM

Yes - definitely something to do with PostGres

Issue: Token refresh broken after Postgres upgrade

Timeline:

Removed pgjwt extension (required for upgrade, verified unused)
Upgraded Postgres: 15.8.1.030 → 17.6
Last successful token refresh: 2025-12-04 10:16:51 UTC
First failed session: 2025-12-04 10:42:32 UTC
All sessions created after upgrade cannot refresh

Error (from auth logs):
"500: missing destination name scopes in *models.Session"
path: /token
grant_type: refresh_token

Database verification:

auth.sessions.scopes column EXISTS (text, nullable)
Schema migrations up to 20251111201300 applied
pgjwt removal was verified safe before upgrade

This appears to be a GoTrue

PostgreSQL 17 compatibility issue.
The Go code's struct mapping is failing on the 'scopes' column.

garyaustin•12/4/25, 2:28 PM

Did you restart the instance?

garyaustin•12/4/25, 2:29 PM

Look in the infrastructure settings for your auth version.

garyaustin•12/4/25, 2:30 PM

I see 2.183.0 in a project last upgraded about a month ago, but PG 17.
And 17 works fine with Auth.

licentiousnessOP•12/4/25, 2:33 PM

ok, let me try. thx

licentiousnessOP•12/4/25, 2:48 PM

Works now!

Restarting the project did the trick. It looks like the Postgres 17 upgrade left the Auth (GoTrue) service slightly out of sync, and the restart forced everything to re-align with the updated schema.

After restarting, /token refresh calls return 200 again and the
missing destination name scopes in *models.Session
error is gone from the auth logs.

Thank you very much for pointing me toward checking the Auth version and doing an instance restart - that solved it.

Appreciated!

Ggaryaustin Restart the project and see if that syncs the auth version. There is no control...

Fil•12/8/25, 4:39 AM

Do you have an auth schema trigger?

What's the issue with an auth.* trigger - what are the rules as to what we should/not do in that regard? I have the following, is this problematic:

CREATE TRIGGER on_auth_user_changed AFTER INSERT OR UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION public.upsert_user_profile();
CREATE TRIGGER on_auth_user_changed AFTER INSERT OR UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION public.upsert_user_profile();

CREATE TRIGGER on_auth_user_changed AFTER INSERT OR UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION public.upsert_user_profile();
CREATE TRIGGER on_auth_user_changed AFTER INSERT OR UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION public.upsert_user_profile();

Also, is a foreign key constraint (and cascade) problematic, targeting

auth.users

auth.users

garyaustin•12/8/25, 2:39 PM

Auth triggers with bad code are the most common case of 500 db errors for Auth calls. You can have fk to auth. You just can’t use the fk to access auth tables thru the REST API.

Ggaryaustin Auth triggers with bad code are the most common case of 500 db errors for Auth c...

Fil•12/9/25, 2:07 AM

Ah, I see so it's: hey your auth may be 500500ing because you are calling a failing trigger. It's not some fundamentally bad thing about triggers in

auth

auth

schema.

garyaustin•12/9/25, 2:08 AM

Not at all.

garyaustin•12/9/25, 2:08 AM

Just 99% chance that is the 500 auth DB error.

garyaustin•12/9/25, 2:09 AM

The OP issue is a blip on the radar with Auth version mismatch hitting some users the past week or two.

Ggaryaustin The OP issue is a blip on the radar with Auth version mismatch hitting some user...

Fil•12/9/25, 2:18 AM

Yep - I experienced that

Is the resolution really restart the db? Does that re-sync the auth version in all cases? This one was nasty I spent a long time researching the root cause.

garyaustin•12/9/25, 2:29 AM

Sorry. I don't know what "this one is". If you mean the OP's issue, that is a rare thing.

Ggaryaustin Sorry. I don't know what "this one is". If you mean the OP's issue, that is a r...

Fil•12/9/25, 2:30 AM

Sorry - "this one" was the auth version mismatch..

garyaustin•12/9/25, 2:30 AM

It was guessing a restart would resolve it.

garyaustin•12/9/25, 2:30 AM

But 1/2 dozen have it it the past week or so.

garyaustin•12/9/25, 2:31 AM

Most are upgrading PG 15 to 17.

Ggaryaustin Most are upgrading PG 15 to 17.

Fil•12/9/25, 2:31 AM

Yep - that's when it hit me

garyaustin•12/9/25, 2:31 AM

Hopefully you will never see this again.

Fil•12/9/25, 2:32 AM

It was a mal-applied migration script to the auth schema?

garyaustin•12/9/25, 2:32 AM

I don't know why it occurred. Sorry.

garyaustin•12/9/25, 2:33 AM

It maybe upgrade does not restart (update auth in the project) and the update loads in a new auth schema without the auth server also being updated.

CREATE TRIGGER on_auth_user_changed AFTER INSERT OR UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION public.upsert_user_profile(); CREATE TRIGGER on_auth_user_changed AFTER INSERT OR UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION public.upsert_user_profile();

Supabase Auth refresh failing with 500: missing destination name scopes in *models.Session

Similar Threads

Similar Threads

Similar Threads