3 people reported

All time, since Oct 16, 2025.

Admin API rejects secret key

Admin calls like createUser and getUserById fail with sb_secret_ keys, locally or after ES256 signing key migration; sometimes intermittent.

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/supabase/issues/9600/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Quiet. No reports in the last two weeks, down from 2 a week at the late-July peak. A workaround is known.

Auth Admin API rejects secret key with invalid JWT error.

Is this your bug?

Where: Auth Admin API
Error text: AuthApiError: invalid JWT: unable to parse or verify signature, token is unverifiable: error while executing keyfunc: unrecognized JWT kid <nil> for algorithm ES256
Versions: 2.51.0 to 2.110.8
How bad: Breaks a normal workflow. Most reports say it used to work.

Not quite your bug?

RLS rejects authenticated requests7 people

Original reports3, newest first

Jul 24, 2026HELP: admin.generateLink / admin.getUserById fail with "unrecognized JWT kid" after JWT Signing Keys migration — blocks Auth Admin API entirely#48323
Jul 23, 2026Intermittent bad_jwt / unrecognized JWT kid on Admin API after ES256 key migration#48246
Oct 16, 2025Supabase client with Secret Key is not compatible with local development#39605

Do you work on Supabase?

Claim its RAP Sheet to see what your users report and answer them in one place.