supabase__server

mirror of https://github.com/supabase/server.git synced 2026-09-14 15:28:52 +08:00

Files

T

History

Tomas Pozo 94a25c9699 docs(auth): order key-based modes before 'user' in all examples

Behind Supabase's API gateway, an apikey request that omits the Authorization
header still reaches the function with a gateway-injected 'Bearer <token>'
(anon for a publishable key, service_role for a secret key). A 'user' mode
placed before the key-based mode then tries to verify that injected token,
fails, and rejects with InvalidCredentialsError before the apikey mode is
reached.

Document the rule — list 'secret'/'publishable' before 'user', keep 'user'
last — across auth-modes, security, api-reference, core-primitives, the adapter
guides, the README, and the withSupabase/verifyCredentials JSDoc, and flip every
combined-auth example to the safe ordering. Corrects the security.md claim that
an absent Authorization header always falls through (true at the SDK level, not
behind the gateway).

2026-06-06 22:02:15 -05:00

adapters

docs(auth): order key-based modes before 'user' in all examples

2026-06-06 22:02:15 -05:00

api-reference.md

docs(auth): order key-based modes before 'user' in all examples

2026-06-06 22:02:15 -05:00

auth-modes.md

docs(auth): order key-based modes before 'user' in all examples

2026-06-06 22:02:15 -05:00

core-primitives.md

docs(auth): order key-based modes before 'user' in all examples