Supabase Auth and GitHub SSH Break Without Warning
10 posts across 2 communities in the last 90 days; 90% from GitHub.
“This isn't about an academic issue though, and who would actually state their RSA key is mathematically sound except in the case that they're performing some research in the field? The point the parent was making was that it was obviously written by AI.”
“Describe the problem/error/question Inability to authenticate using GHL credentials (API key or oauth) What is the error message (if any)? Couldn’t connect with these settings Unauthorised Please share your workflow/screenshots/recording”
“Bug report (URLane/ MyGoBox Project), the exact error ("invalid login credentials" on signInWithPassword for existing users, while signUp succeeds for new users) Upgraded to Pro suspecting I could have reached a limit. My issue persists.”
Several posts highlight issues with software development tools and platforms, including SSH key rejections on GitHub, problems with Supabase services (authentication, database access), and difficulties with edge functions. Developers are frustrated by unexpected errors, instability, and limitations in functionality.
SOURCES (16)
“Goal Fail fast (or at least surface a health signal) when the JWKS URL is unreachable/malformed at startup, and make the "retry on first request" the code documents actually happen promptly instead of falling back to a long background refresh window. Context (everything the chat…”
“Summary OAuth /authorize page show {"error":"invalid request"} Steps to reproduce 1. Set export JWT SECRET="$(openssl rand base64 32)" 2. Run tutor mcp (prebuilt binary downloaded from GitHub release, linux amd64) 3. Setup HTTP MCP with OAuth config for Hermes Agent as written in https://hermes agent.nousresearch.com/docs/user guide/features/mcp oauth authenticated http servers 4. Run hermes mcp login tutor mcp Expected behavior Login page like v0.4.1 Actual behavior Page shows {"error":"invalid”
“Project psgehcgzoxongohdfzen is reproducing PGRST303 — JWT issued at future. A newly created and confirmed Auth user signs in normally, but the first authenticated PostgREST/Data API read (athlete journey facts) fails immediately with PGRST303. We do not mint or modify JWTs and have not added client side retries or delays. The project’s database permissions/RLS have been independently verified. This appears consistent with the currently open Supabase JWT rejection incident. Can you confirm wheth”
“Confirmed by the operator watching a real tester do it, 2026 09 02 17:52 CDT, on 0.6.22. This is the root cause of the Ben cluster's dead end, and it is RECURRING it has happened to at least one other user before. Josh, relaying Ben, verbatim: "When he clicked Sign In again, it didn't create a second account row. He had to go and hit 'Add another provider' to add the second account row. But when he hits Sign In again, it takes him through the flow and it looks like it authorized. It real quickly”
“The text in the error message is: "Failed to add login event: JWT failed verification". Please, solve ASAP”
“Project ref: eerlbaomxcgifihlqlhq (org: mhwvmwvnwhbogodczcln, "Retrocracy", eu central 1) We're intermittently getting 401s with PostgREST; error=PGRST303 ("JWT issued at future") on REST calls authenticated with our service role key. Notably, we are already on the new non JWT sb secret ... key format, not a legacy JWT based service role key — so this doesn't match the usual "clock skew on a freshly issued Auth JWT" explanation, since no JWT is being presented by our client at all. Clearest repr”
“[X] I confirm this is a bug with Supabase, not with my own application. [X] I confirm I have searched the Docs, GitHub Discussions, and Discord. Describe the bug I have repeatedly tried to sign in with GitHub, also rebooting my PC, but it does not work. To Reproduce Steps to reproduce the behavior, please provide code snippets or a repository: 1. Go to https://supabase.com/dashboard/sign in 2. Click on Continue with GitHub 3. See error Error while signing in Error: Error getting user profile fro”
“Describe the problem/error/question Inability to authenticate using GHL credentials (API key or oauth) What is the error message (if any)? Couldn’t connect with these settings Unauthorised Please share your workflow/screenshots/recording <img width="1126" height="309" alt="Image" src="https://github.com/user attachments/assets/520aef2b 333a 4381 86ca 21b7b6ee833f" / Share the output returned by the last node Debug info core n8nVersion: 2.35.2 platform: docker (cloud) nodeJsVersion: 24.18.1 nodeE”
“Project ref: balespnjhnuubfmxhqmf Since approximately 2026 07 24 (AEST), our current format sb secret key is intermittently rejected on /auth/v1/admin/users (create user/delete user) with 403 unrecognized JWT kid <nil for algorithm ES256 — the same calls succeeded consistently before that date. Repeated identical requests show a mixed pass/fail pattern (≈7/8 with apikey header only, ≈4/8 when the key is also sent as Bearer), consistent with a partial/rolling enforcement rollout across instances.”
“This isn't about an academic issue though, and who would actually state their RSA key is mathematically sound except in the case that they're performing some research in the field? The point the parent was making was that it was obviously written by AI.”
“Bug report [x] I confirm this is a bug with Supabase, not with my own application. [x] I confirm I have searched the Docs, GitHub Discussions, and Discord. Describe the bug In Studio's SQL editor store, removeFavorite and addFavorite guard against a missing snippet differently, and removeFavorite gets it wrong. addFavorite checks if (storeSnippet) before touching the snippet, so calling it with an id that is not loaded in the store is a safe no op. removeFavorite checks if (storeSnippet.snippet)”
“Bug report O GoTrue (auth) está 503 consistente. O REST API e Edge Functions funcionam normalmente, mas o Auth service não sobe. Isso precisa ser resolvido pelo Suporte do Supabase — eles precisam verificar por que o GoTrue está em crash loop.”
“Bug report (URLane/ MyGoBox Project), the exact error ("invalid login credentials" on signInWithPassword for existing users, while signUp succeeds for new users) Upgraded to Pro suspecting I could have reached a limit. My issue persists.”
“Edge functions rejecting legacy HS256 JWTs since today Title: Edge Functions returning 401 UNAUTHORIZED LEGACY JWT for valid legacy JWTs since today — Postgres unaffected Body: Since this morning (Jul 8), all Edge Function calls from our app suddenly fail with a 401, even though the session and tokens are valid and present. Nothing changed on our side, and it worked fine yesterday. Error (client side): {"code":"UNAUTHORIZED LEGACY JWT","message":"Invalid JWT"} HTTP 401 (Unauthorized) What we've”
“The Supabase API Gateway protecting Edge Functions (verify jwt: true) is throwing a 401 Unauthorized error when passed a valid User Session token. Upon inspecting the raw Bearer token, we found that the GoTrue Auth module is generating modern ES256 (Elliptic Curve) JWTs (the token header begins with eyJhbGciOiJFUzI... {"alg":"ES256"}). However, the Edge Function Native Gateway appears to be failing to validate this algorithm, likely because it is hard expecting an HS256 token signed by the proje”
“Bug report [x] I confirm this is a bug with Supabase, not with my own application. [x] I confirm I have searched the Docs, GitHub Discussions, and Discord. Describe the bug Authentication fails when algorithm is set to ES256. The documentation recommends to use jose with a AuthMiddleware, reading the data from URL(Deno.env.get("SUPABASE URL")! + "/auth/v1/.well known/jwks.json") . This file return alg="ES256" Jose throws JOSENotSupported: Unsupported "alg" value for a JSON Web Key Set , this err”