AuthSessionMissingError: Auth session missing!

By Ohad Krispin, founder of VibeRaven · LinkedIn

"AuthSessionMissingError: Auth session missing!" means a supabase-js auth call that needs a signed-in user found no session on that client: getUser(), updateUser(), refreshSession() and reauthenticate() return or throw it when nobody is signed in. For a signed-out visitor that is expected, so treat it as "no user", not a crash. When the user did sign in and you still get it, the client that made the call has no session: server code created without the request's auth cookies, a call made before the browser client had the session, or a session the Auth server no longer has because the user signed out. In Next.js, create the server client with @supabase/ssr and the request's cookies, and refresh the session in proxy.ts (middleware.ts before Next.js 16). Checked against the supabase-js source and a supabase-js 2.118.0 run on 2026-10-25.

supabase-js 2.118.0 with nobody signed in: getUser returns user null and AuthSessionMissingError with status 400, updateUser returns the same error, and getSession returns a null session with no error.

Signed in, but your RLS policies still see an anonymous request? See why auth.uid() is null in a policy.

Which calls return it, and which do not

In supabase-js, getUser() with no access token returns { user: null } with this error instead of calling the Auth server, as our run showed with status 400. updateUser(), refreshSession(), setSession() without both tokens, and reauthenticate() return it too. getSession() does not: it returns a null session and no error. getClaims() also returned null data and no error in our run, and signOut() returned no error.

Signed out on another device, or the session was ended

The client also returns it when it sends a token whose session the Auth server no longer has: the server answers with error code session_not_found, which supabase-js turns into AuthSessionMissingError and then removes the stored session. Its source names the causes: the user signed out, was deleted, or the session was ended. Send the user to sign in again.

In Next.js server code

A Server Component, Route Handler or Server Action has a session only if its client reads the request's cookies. Supabase's Next.js guide creates it with createServerClient from @supabase/ssr and the cookies() store, and refreshes the session in proxy.ts by calling supabase.auth.getClaims(), because Server Components cannot write cookies. A client from createClient in @supabase/supabase-js keeps its session in memory, so on the server it has none, and getUser() returns this error for a signed-in user.

The same guide says to protect pages with getClaims() and never to trust getSession() in server code.

A call made before the client has the session, such as getUser() in the first render after a redirect from sign-in, finds none. Read the user after the session is there, for example from onAuthStateChange, and show a loading state until then.

Checklist

How to fix it, then check the fix

Treat a missing session as signed out instead of throwing:

const { data, error } = await supabase.auth.getUser()
if (error?.name === 'AuthSessionMissingError' || !data.user) {
  // signed out: show the sign-in page
}

02In server code, check that the client is created with @supabase/ssr createServerClient and the request's cookies, not with createClient from @supabase/supabase-js.
03In Next.js, check that proxy.ts (or middleware.ts before Next.js 16) runs on the routes that read the user and refreshes the session.
04In the browser, read the user after the session is restored, not in the first render after the sign-in redirect.
05Sign in, reload a protected page and call the server route that failed: getUser() returns the user, and signed out it returns this error.

Sources

Official docs behind this checklist

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Is this error a bug in my app?

Not when nobody is signed in: supabase-js returns it for every signed-out call to getUser(). It is a bug when a signed-in user gets it, because the client that made the call has no session.

Why does getSession() work when getUser() fails?

They read different places. getSession() reads the client's stored session without checking it with the Auth server, so it returns null quietly; getUser() needs an access token and returns this error when there is none.