* fix: reject invalid JWTs immediately instead of falling through to next auth mode
Introduce an INVALID sentinel so tryMode can distinguish "credential
present but failed" from "credential absent." The main loop now short-
circuits on INVALID instead of silently trying the next allowed mode.
Also covers the case where a JWT verifies cryptographically but has no
sub claim (or sub isn't a string) -- previously returned null (fallthrough),
now returns INVALID (reject).
BREAKING CHANGE: when multiple auth modes are allowed, a present-but-invalid
JWT is now rejected with InvalidCredentialsError instead of falling through
to the next mode. Clients that previously relied on silent fallthrough
(e.g., stale token + valid apikey) must now either omit the Authorization
header or refresh the token.
* docs: clarify invalid-JWT no-fallthrough semantics
Align documentation with the behavior introduced in the fix!: commit on
this branch. Make clear across user-facing docs, TSDoc, and SKILL that:
- A mode is "tried" only when its credential is actually present, so a
request with no Authorization header still falls through.
- A JWT that is present but fails verification (malformed, expired, wrong
signature, missing sub) rejects with InvalidCredentialsError — it does
not silently fall through to another allowed mode.
Touches README, docs/auth-modes, docs/security, docs/error-handling,
docs/api-reference, skills/supabase-server/SKILL, and TSDoc on the Allow
type, WithSupabaseConfig.allow, and verifyCredentials.
---------
Co-authored-by: Tomas Pozo <tomaspozogarzon@gmail.com>
* fix: correctly passing down the keyName based on authType
- Only passing keyName for during 'createContextClient' if the authType
is public
* feat: exposing 'keyName' to SupabaseContext
* docs: adding 'authKeyName' reference
Webhook signature verification varies too much across providers
to justify a generic helper. Each case should be handled with
the provider's own SDK (e.g., Stripe, GitHub).
* docs: add initial documentation and skills.md
* docs: apply formatting
* docs: update SKILL.md to resolve docs from package location and ship docs with npm
SKILL.md now instructs agents to find documentation in the installed
@supabase/server package (node_modules or repo root) instead of using
relative paths. Added docs/ and SKILL.md to package.json files array
so they ship with npm installs.
* docs: add missing HTTPException import in error-handling example
* docs: fix strictNullChecks issues, duplicate variables, and missing context in examples
- Add non-null assertions (!) after error guards where TS can't narrow
destructured result tuples
- Split duplicate variable declarations into separate code blocks
- Add missing imports and show where variables like `auth` come from
- Keep { data, error } destructuring pattern consistent with SDK convention
* docs: reframe as runtime-agnostic and add env auto-injection details
- getting-started: replace Edge Function framing with runtime-neutral
language, explain module worker pattern works across Deno/Bun/Workers,
add Runtimes section covering all supported environments
- webhooks: replace Deno.env with process.env for portable examples
- environment-variables: add "Auto-injected in" column distinguishing
Platform vs Local CLI, reframe section headers
- auth-modes: clean up example key values
- core-primitives: clarify "Integration with frameworks" wording
- types: simplify TSDoc for publishable/secret key descriptions
* docs: add SSR frameworks guide and update references
Add docs/ssr-frameworks.md covering the pattern for using core
primitives in Next.js, SvelteKit, Nuxt, and Remix — cookie extraction,
env bridging, JWKS caching, and a complete Next.js adapter example.
Replace the basic SSR example in core-primitives.md with a pointer
to the new dedicated doc. Add SSR row to SKILL.md routing table.
* docs: add disclaimer of new package
* docs: extend explanation on keys env vars
* docs: add platform-specific quick starts to SKILL.md
Split the single generic example into per-platform sections
(Edge Functions, Cloudflare Workers, Hono, SSR Frameworks) so
AI agents pick the correct import specifier for each runtime.
Adds npm: prefix to all Deno examples and a Deno column to the
entry points table. Also adds createSupabaseContext examples.
* docs: add server-to-server quick starts and allow:always guardrails
Add secret key auth and webhook signature verification quick starts
to SKILL.md. Add explicit decision tree for allow:'always' so AI
agents confirm with the user before leaving endpoints unprotected.
* docs: add legacy keys warning, skills install, remove webhook docs
- Add legacy keys warning to SKILL.md (avoid anon/service_role keys)
- Add AI coding skills install section to README
- Add server-to-server quick start with caller code to README
- Add runtimes, documentation table, and named secret keys to README
- Remove verifyWebhookSignature references from all docs
- Delete docs/webhooks.md (code removal in separate PR)
* docs: add verify_jwt = false note for non-user auth modes
Edge Functions require verify_jwt = false in config.toml when
using allow: public, secret, or always — otherwise the platform
rejects requests before the handler runs.
* docs: add edge function recipes and refactor env vars doc
Add recipes for function-to-function calls, pg_net from database,
Stripe webhooks, and generic webhook signature verification.
Document the @supabase/server/wrappers entry point.
Refactor environment-variables.md into Supabase vs non-Supabase sections.
* docs: add security doc covering timing-safe comparison, auth model, CORS
* docs: link auth-modes timing-safe mentions to security.md
* docs: adding 'local cli' to secrets table
This envs will be injected from cli too
* docs: setting Deno as first installation choice
* docs: adding 'verify_jwt=false' disclaimer for non-user auth
* docs: split Deno/Supabase runtime section, merge Deno/Node/Bun
* docs(skills): adding legacy code migration example
* docs(skills): explaining why legacy code should be migrated
* docs: rewrite migration section, improve skill description triggers
---------
Co-authored-by: Kalleby Santos <kalleby_santos@hotmail.com>
* feat: add `supabaseOptions` to `WithSupabaseConfig` for client customization
Allow users to pass `SupabaseClientOptions` through to the internal
`createClient` calls, enabling custom schemas, fetch, and realtime config
while security-critical auth settings remain force-overwritten.
* fix: sanitize Authorization and apikey headers from supabaseOptions
User-provided supabaseOptions.global.headers could include Authorization
or apikey, bypassing verified credentials. Strip both before spreading
user headers into the client options.
* docs: add comprehensive TSDoc comments with embedded examples across all source files
Add JSDoc/TSDoc documentation to every exported function, type, interface,
and error class. Includes @param, @returns, @throws, @example with
copy-pasteable code, @see cross-references, and @packageDocumentation
module overviews. Examples use the runtime-agnostic `export default { fetch }`
pattern instead of Deno-specific APIs.
* docs: align annotations with @supabase/server naming and runtime-agnostic framing
- Replace all @supabase/edge-functions imports with @supabase/server across 13 source files
- Frame withSupabase as built for the Web API Request/Response standard
- Explain adapter purpose: frameworks wrap the runtime's native standards, adapters bridge the gap
- Fix CONTRIBUTING.md repo URL from edge-functions to server
* docs: trim inline comments to practical scope — one summary, one example
Move architecture explanations, auth mode tables, multi-example variations,
and cryptographic theory out of inline TSDoc. Keep each doc comment focused
on what the function does and one copy-pasteable example.
* docs: fix @packageDocumentation tag placement and Cloudflare Workers caveat
- Move @packageDocumentation to its own line in barrel files (TSDoc spec requirement)
- Clarify that Cloudflare Workers need node-compat or overrides for env resolution
* fix: use matched key name for client creation instead of always defaulting
verifyCredentials now returns the matched keyName in AuthResult.
createContextClient and createAdminClient accept an optional keyName
parameter, falling back to 'default' when not provided.
* test: add keyName resolution tests and fix fallback to first available key
Client creation now falls back to first available key when no 'default'
exists and keyName is null. Tests cover named keys, wildcard matching
non-first keys, and the full fallback chain.
* docs: update README samples to export default format and clean up imports
* fix: use null check for keyName fallback and tailor error messages
Use keyName == null instead of truthiness check so empty strings
don't incorrectly trigger fallback. Error messages now only suggest
SUPABASE_*_KEY for the default key, not for named keys.
* fix: only pass keyName to admin client for secret auth, make keyName optional
Admin client now only receives keyName when authType is 'secret',
preventing mismatched key lookups when auth is public. AuthResult.keyName
is now optional to avoid breaking consumers who construct the type.
* fix: support bare array format for SUPABASE_JWKS env var
The platform provides JWKS as a JSON array [...] but parseJwks
expected { keys: [...] }. Now wraps bare arrays automatically.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add platform env var integration test for resolveEnv
Verifies parsing of real platform env var shapes: multiple
named keys and bare JWKS array with two EC key entries.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: validate parseJwks input before casting to JsonWebKeySet
Reject valid JSON that isn't a valid JWKS (e.g. primitives, empty
objects, objects with non-array `keys`) instead of blindly casting.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Robert Soriano