fix(functions): stop sending API key in Authorization header for function calls by mandarini · Pull Request #2511 · supabase/supabase-js · GitHub

Description

Edge Function calls (supabase.functions.invoke()) no longer put the project API key in the Authorization header when there is no user session. The key is sent only in the apikey header, and Authorization is reserved for a real user (or custom) session token, matching the Server SDK pattern.

What changed?

packages/core/supabase-js/src/lib/fetch.ts: fetchWithAuth accepts a new optional { isFunctionsClient } flag. When set, it no longer falls back to sending the API key as Authorization: Bearer <key>, but only for new-format keys (sb_publishable_... / sb_secret_...). A real session/custom token is still sent, and the apikey header is unchanged.
packages/core/supabase-js/src/SupabaseClient.ts: added a dedicated functionsFetch built with { isFunctionsClient: true }. The functions getter uses it; REST (PostgREST), Storage, and Realtime keep the shared fetch and are unaffected.
packages/core/functions-js/src/FunctionsClient.ts: updated the invoke JSDoc to describe the apikey vs Authorization header semantics.
docs/MIGRATION.md: added an "Edge Functions auth headers" section documenting the behavior and the one edge case that is affected.
Tests: added unit coverage in fetch.test.ts for the isFunctionsClient option and an integration case in SupabaseClient.test.ts proving functions omit Authorization for a new-format key with no session while other services do not.

Why was this change needed?

New-format API keys (sb_publishable_... / sb_secret_...) are not JWTs, so sending them as Authorization: Bearer <key> caused the gateway to reject the request with "invalid token format." A platform apikey-compatibility patch (now GA) lets verify_jwt=true functions be called with only the apikey header, so the SDK no longer needs to duplicate the key into Authorization. This aligns Functions with the Server SDK convention: Authorization is for user/custom tokens only.

Closes SDK-1050.

Screenshots/Examples

Unauthenticated function call with a new-format key:

Before:

apikey: sb_publishable_...
Authorization: Bearer sb_publishable_...   # rejected as "invalid token format"

After:

apikey: sb_publishable_...
# no Authorization header

Authenticated call (unchanged):

apikey: sb_publishable_...
Authorization: Bearer <user_jwt>

Breaking changes

The change is scoped to Edge Functions only, and legacy JWT keys keep their existing behavior (still sent in Authorization for backward compatibility), so this is not a breaking change in practice. The only impacted case is code that reads the API key out of the Authorization header inside an Edge Function; those should read the apikey header instead, or migrate to @supabase/server.

This PR contains no breaking changes

Checklist

I have read the Contributing Guidelines
My PR title follows the conventional commit format: <type>(<scope>): <description>
I have run pnpm nx format to ensure consistent code formatting
I have added tests for new functionality (if applicable)
I have updated documentation (if applicable)

Additional notes

Scope is intentionally limited to new-format keys so there is zero regression risk for self-hosted or legacy-key users on older gateways. Moving to an unconditional drop for all key types later is a one-line change (removing the key-format guard in fetch.ts), best done on v3 or once apikey-compatibility is universal.

…tion calls

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2511

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2511

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2511

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2511

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2511

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2511

commit: 7500549

coverage: 80.484% (+0.04%) from 80.446% — fix/functions-omit-apikey-authorization into master

…ader logic Future-proof the sb_ key family per auth-team guidance (stojan): createClient() now validates the key format at construction and throws for a key that starts with sb_ but is not a recognized subtype (sb_publishable_ / sb_secret_), signalling that the SDK must be upgraded to support the new type. Legacy JWT keys (no sb_ prefix) and the two recognized subtypes are unaffected, so no key that works today starts failing — this is not a breaking change. Also addresses review feedback on fetch.ts: - rename the fetchWithAuth option isFunctionsClient -> omitApiKeyAsBearer so the generic util no longer knows about a "functions client" - compute the key-as-Bearer decision once at construction instead of per request - drop the accessToken === supabaseKey equality proxy; split a raw _getSessionToken() (null when no session) from the coalescing _getAccessToken(), and feed the raw getter to the fetch wrappers so Authorization fallback lives in one place - collapse the triplicated rationale comment to a single canonical location Realtime keeps using _getAccessToken(); PostgREST/Storage behavior is unchanged.

LGTM 💚

This PR updates `@supabase/supabase-js` to v2.110.5. **Source**: supabase-js-stable-release --- ## Release Notes ## v2.110.5 ## 2.110.5 (2026-07-14) ### 🩹 Fixes - **supabase:** avoid edge runtime warning ([#2522](supabase/supabase-js#2522)) ### ❤️ Thank You - Vaibhav @7ttp ## v2.110.4 ## 2.110.4 (2026-07-14) ### 🩹 Fixes - **functions:** stop sending API key in Authorization header for function calls ([#2511](supabase/supabase-js#2511)) - **realtime:** encode broadcast header fields as UTF-8 ([#2516](supabase/supabase-js#2516)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Pedro Henrique This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>

This PR updates @supabase/*-js libraries to version 2.110.5. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.110.5 - Updated @supabase/auth-js to 2.110.5 - Updated @supabase/realtime-js to 2.110.5 - Updated @supabase/postgest-js to 2.110.5 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.110.5 ## 2.110.5 (2026-07-14) ### 🩹 Fixes - **supabase:** avoid edge runtime warning ([#2522](supabase/supabase-js#2522)) ### ❤️ Thank You - Vaibhav @7ttp ## v2.110.4 ## 2.110.4 (2026-07-14) ### 🩹 Fixes - **functions:** stop sending API key in Authorization header for function calls ([#2511](supabase/supabase-js#2511)) - **realtime:** encode broadcast header fields as UTF-8 ([#2516](supabase/supabase-js#2516)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Pedro Henrique ## v2.110.3 ## 2.110.3 (2026-07-13) ### 🩹 Fixes - **auth:** preserve pkce verifier ([#2513](supabase/supabase-js#2513)) - **postgrest:** pin tstyche target off floating latest ([#2509](supabase/supabase-js#2509)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Vaibhav @7ttp ## v2.110.2 ## 2.110.2 (2026-07-09) ### 🩹 Fixes - **auth:** clear local session on signout failures ([#2504](supabase/supabase-js#2504)) ### ❤️ Thank You - Luc Peng This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>

This PR updates @supabase/*-js libraries to version 2.110.6. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.110.6 - Updated @supabase/auth-js to 2.110.6 - Updated @supabase/realtime-js to 2.110.6 - Updated @supabase/postgest-js to 2.110.6 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.110.6 ## 2.110.6 (2026-07-15) ### 🩹 Fixes - **postgrest:** type hinted self-referencing embeds as arrays ([#2520](supabase/supabase-js#2520)) - **realtime:** forward opts to send() in track() ([#2490](supabase/supabase-js#2490)) - **supabase:** warn instead of throw for unrecognized sb_ API key subtypes ([#2526](supabase/supabase-js#2526)) ### ❤️ Thank You - Franco Kaddour @FrancoKaddour - Katerina Skroumpelou @mandarini ## v2.110.5 ## 2.110.5 (2026-07-14) ### 🩹 Fixes - **supabase:** avoid edge runtime warning ([#2522](supabase/supabase-js#2522)) ### ❤️ Thank You - Vaibhav @7ttp ## v2.110.4 ## 2.110.4 (2026-07-14) ### 🩹 Fixes - **functions:** stop sending API key in Authorization header for function calls ([#2511](supabase/supabase-js#2511)) - **realtime:** encode broadcast header fields as UTF-8 ([#2516](supabase/supabase-js#2516)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Pedro Henrique ## v2.110.3 ## 2.110.3 (2026-07-13) ### 🩹 Fixes - **auth:** preserve pkce verifier ([#2513](supabase/supabase-js#2513)) - **postgrest:** pin tstyche target off floating latest ([#2509](supabase/supabase-js#2509)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Vaibhav @7ttp ## v2.110.2 ## 2.110.2 (2026-07-09) ### 🩹 Fixes - **auth:** clear local session on signout failures ([#2504](supabase/supabase-js#2504)) ### ❤️ Thank You - Luc Peng This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>

fix(functions): stop sending API key in Authorization header for func…

8448e79

…tion calls

mandarini self-assigned this Jul 10, 2026

github-actions Bot added the functions-js Related to the functions-js library. label Jul 10, 2026

kallebysantos previously approved these changes Jul 10, 2026

View reviewed changes

mandarini marked this pull request as ready for review July 10, 2026 12:29

mandarini requested review from a team as code owners July 10, 2026 12:29

Tr00d previously approved these changes Jul 10, 2026

View reviewed changes

grdsdev previously approved these changes Jul 10, 2026

View reviewed changes

spydon reviewed Jul 10, 2026

View reviewed changes

mandarini added the do-not-merge Do not merge this PR. label Jul 10, 2026

mandarini dismissed stale reviews from grdsdev, Tr00d, and kallebysantos via 7500549 July 13, 2026 13:19

mandarini requested review from grdsdev, kallebysantos and spydon July 13, 2026 13:21

mandarini removed the do-not-merge Do not merge this PR. label Jul 13, 2026

kallebysantos approved these changes Jul 13, 2026

View reviewed changes

spydon approved these changes Jul 13, 2026

View reviewed changes

mandarini merged commit 558c1f5 into master Jul 13, 2026
55 of 61 checks passed

mandarini deleted the fix/functions-omit-apikey-authorization branch July 13, 2026 15:27

supabase-supabase-autofixer Bot mentioned this pull request Jul 14, 2026

chore: update @supabase/supabase-js to v2.110.4 supabase/multiplayer.dev#75

Merged

This was referenced Jul 14, 2026

chore: update @supabase/supabase-js to v2.110.4 supabase/realtime#2020

Closed

chore: update @supabase/supabase-js to v2.110.4 supabase/ssr#262

Closed

supabase-supabase-autofixer Bot mentioned this pull request Jul 14, 2026

feat: update @supabase/*-js libraries to v2.110.4 supabase/supabase#47909

Closed

supabase-libs-pr-manager Bot mentioned this pull request Jul 14, 2026

chore: update @supabase/supabase-js to v2.110.5 supabase/realtime#2021

Merged

supabase-libs-pr-manager Bot mentioned this pull request Jul 14, 2026

chore: update @supabase/supabase-js to v2.110.5 supabase/ssr#263

Merged

supabase-supabase-autofixer Bot mentioned this pull request Jul 14, 2026

feat: update @supabase/*-js libraries to v2.110.5 supabase/supabase#47918

Merged

mandarini mentioned this pull request Jul 15, 2026

fix(supabase): warn instead of throw for unrecognized sb_ API key subtypes #2526

Merged

6 tasks

This was referenced Jul 15, 2026

feat: update @supabase/*-js libraries to v2.110.6-canary.2 supabase/supabase#47967

Closed

feat: update @supabase/*-js libraries to v2.110.6 supabase/supabase#47968

Merged

This was referenced Jul 16, 2026

parity(functions): never send new-format API key as Authorization Bearer [from supabase-js] supabase-community/supabase-kt#1357

Closed

parity(functions): never send new-format API key as Authorization Bearer [from supabase-js] supabase/supabase-csharp#279

Open

coderabbitai Bot mentioned this pull request Jul 28, 2026

Move AI provider keys server-side; support env-configured Google Client ID am225723/compliance#4

Merged

fix(functions): stop sending API key in Authorization header for function calls by mandarini · Pull Request #2511 · supabase/supabase-js · GitHub

fix(functions): stop sending API key in Authorization header for function calls - #2511

fix(functions): stop sending API key in Authorization header for function calls#2511
mandarini merged 2 commits into
masterfrom
fix/functions-omit-apikey-authorization

mandarini commented Jul 10, 2026 •
edited
Loading

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jul 10, 2026 •
edited
Loading

Uh oh!

Uh oh!

coveralls commented Jul 10, 2026 •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kallebysantos left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

fix(functions): stop sending API key in Authorization header for function calls by mandarini · Pull Request #2511 · supabase/supabase-js · GitHub

fix(functions): stop sending API key in Authorization header for function calls - #2511

fix(functions): stop sending API key in Authorization header for function calls#2511mandarini merged 2 commits intomastersupabase/supabase-js:masterfrom fix/functions-omit-apikey-authorizationsupabase/supabase-js:fix/functions-omit-apikey-authorizationCopy head branch name to clipboard

Conversation

mandarini commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What changed?

Why was this change needed?

Screenshots/Examples

Breaking changes

Checklist

Additional notes

Uh oh!

pkg-pr-new Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kallebysantos left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

fix(functions): stop sending API key in Authorization header for function calls#2511
mandarini merged 2 commits into
masterfrom
fix/functions-omit-apikey-authorization

mandarini commented Jul 10, 2026 •
edited
Loading

pkg-pr-new Bot commented Jul 10, 2026 •
edited
Loading

coveralls commented Jul 10, 2026 •
edited
Loading