Supabase errors: exact messages and their fixes

19 errors

Supabase error messages, A to Z

• AuthSessionMissingError: Auth session missing!

  Supabase AuthSessionMissingError: getUser() or updateUser() ran on a client with no session: a signed-out visitor, or server code without the auth cookies.

• connect ENETUNREACH

  connect ENETUNREACH from Railway to db.<ref>.supabase.co: the direct host is IPv6 only and Railway egress is IPv4 by default. Use the session pooler on 5432.

• Could not find the table 'public.<table>' in the schema cache

  PGRST205 means the Supabase API has no table by that name: a typo, a migration not applied to this project, or a stale cache. Check, then reload the schema.

• Edge Function returned a non-2xx status code

  Supabase "Edge Function returned a non-2xx status code" hides the real error: read error.context for the status and body, then fix the function or its secrets.

• email rate limit exceeded

  Supabase Auth returns email rate limit exceeded (429) after 2 emails an hour on the built-in provider. Set up custom SMTP, then raise the limit in Rate Limits.

• Error sending confirmation email

  Supabase returns 500 "Error sending confirmation email" when the SMTP server refuses the message. With Resend, check the API key, sender domain and port.

• Failed to send a request to the Edge Function

  supabase-js throws FunctionsFetchError when the request never got a response: a wrong project URL, a function not deployed, CORS, or a timeout.

• infinite recursion detected in policy for relation

  Postgres raises 42P17 when an RLS policy queries its own table, often an admin check on profiles. Move the check into a security definer function.

• Invalid API key

  Supabase "Invalid API key" (401): the apikey header holds a key this project does not accept, such as one from another project. Copy both from one project.

• JWT expired

  Supabase returns 401 JWT expired when a request carries an access token past its exp, often one copied into a header or cookie and never refreshed.

• Max client connections reached

  On Vercel, connect to Supabase through the transaction pooler on port 6543, not the 5432 session pooler; set prepare: false (pgbouncer=true in Prisma).

• new row violates row-level security policy or must be owner of table objects

  Storage uploads need an INSERT policy on storage.objects, and upsert also needs SELECT and UPDATE. Never alter storage.objects: RLS is already on.

• new row violates row-level security policy

  Supabase "new row violates row-level security policy" (42501): no INSERT or UPDATE policy passed the row. Add one with WITH CHECK, and SELECT for .select().

• No matching signature found

  A Resend webhook into a Supabase Edge Function needs verify_jwt = false, then svix on the raw body. Parsing JSON first fails with No matching signature found.

• permission denied for schema public

  Postgres 42501 for a schema means the API roles lost USAGE on it. Grant usage on schema public to anon, authenticated and service_role, then the tables.

• permission denied for table

  Supabase "permission denied for table" (42501): the anon or authenticated role has no grant. Not an RLS policy. Fix: grant select on the table to that role.

• Secrets scanning found secrets in build

  Netlify fails the build when a variable marked secret, such as VITE_SUPABASE_ANON_KEY, is in the bundle. Omit public keys only; the service key must fail.

• SubtleCryptoProvider cannot be used in a synchronous context

  Stripe throws "SubtleCryptoProvider cannot be used in a synchronous context" in Supabase Edge Functions. Verify with constructEventAsync instead.

• Your project's URL and Key are required to create a Supabase client!

  Your project's URL and Key are required (or supabaseUrl is required.) means the Supabase URL or key env var was empty. Set both in Vercel and redeploy.

How to use it

How to use this index

Look for the text your app, build log or browser console printed, without the parts that change between projects: table names, IDs, routes and URLs. The list is sorted by that text.

Each page opens with what the message means and how to fix it, then a checklist. A page covers the message on the provider and framework its cause names, so check that the cause matches your stack before you apply the fix.

Vercel errors · Next.js errors · Stripe errors · All provider errors