No API key found in request

Checklist

How to fix it, then check the fix

1. 01Find the failing request in the browser's Network tab, or in your server or cron logs, and note its path (/rest/v1, /auth/v1 or /storage/v1). Open its request headers and check whether an apikey header is there.
2. 02
   Reproduce it outside the app. The first request has no key and gets this 401; the second sends the publishable key from Settings > API Keys and should not:

   curl -i "https://[PROJECT-REF].supabase.co/rest/v1/[TABLE]?select=*&limit=1"
   
   curl -i "https://[PROJECT-REF].supabase.co/rest/v1/[TABLE]?select=*&limit=1" \
     -H "apikey: [PUBLISHABLE-KEY]"

3. 03
   Where the app calls the API with plain fetch, send the key on the apikey header, and stop with a clear error when the variable is empty instead of sending the request without it:

   const key = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
   if (!key) throw new Error('NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY is not set')
   
   const res = await fetch('https://[PROJECT-REF].supabase.co/rest/v1/[TABLE]?select=*', {
     headers: { apikey: key },
   })

4. 04
   Or make the call through supabase-js. It adds the apikey header to every request, and it throws "supabaseKey is required." when the key is empty rather than sending a request without one:

   import { createClient } from '@supabase/supabase-js'
   
   const supabase = createClient('https://[PROJECT-REF].supabase.co', '[PUBLISHABLE-KEY]')
   const { data, error } = await supabase.from('[TABLE]').select('*').limit(1)

5. 05
   List the variable names your code reads for the key and compare them with the names set in Vercel. NEXT_PUBLIC_SUPABASE_ANON_KEY in the code and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY in Vercel (or the VITE_ versions) leaves the value empty:

   grep -rnE "SUPABASE_(ANON|PUBLISHABLE)_KEY|apikey" --include=*.ts --include=*.tsx --include=*.js --exclude-dir=node_modules .

6. 06Set the value in Vercel under that exact name for Production and Preview, then redeploy. A deployment keeps the variables it was built with, and NEXT_PUBLIC_ and VITE_ values are written into the browser bundle at build time.
7. 07If the message shows in a browser tab after an email link or an OAuth sign-in, the browser was sent to a Supabase API address instead of your app. Check that the Site URL under Authentication > URL Configuration starts with https:// and that the redirectTo you pass is on the Redirect URLs list.
8. 08For cron jobs and webhook senders that call /rest/v1 or /storage/v1, add the apikey header from a key stored on that server. Keep secret and service_role keys out of browser code: Supabase returns 401 when a secret key is sent from a browser.

Related

Related guides

• SupabaseInvalid API keyGuide
• SupabaseVercel"Your project's URL and Key are required to create a Supabase client!" on Vercel: the fixGuide
• SupabaseSupabase API keys: publishable, secret, anon or service role?Guide
• SupabaseEdge Function returned a non-2xx status codeGuide

Sources

Official docs behind this checklist

• Supabase, Creating API routes
• Supabase, JWT signing keys (the API gateway and the apikey header)
• Supabase, API keys
• Supabase, Edge Function 401 error response
• Supabase, Redirect URLs
• supabase-js source: the apikey header on every request
• supabase/supabase issue 17246, the full response body
• Vercel, Environment variables

FAQ

FAQ for builders before launch