Short answer
The Supabase client you called has no session stored. On the server, create the client with @supabase/ssr and pass it the request’s cookies, and add the proxy (middleware.ts before Next.js 16) that refreshes the session. In the browser, wait until the session has loaded before calling getUser() or updateUser(). On a password reset page, make sure the link’s session is set before updating the password.
Why the client has no session
01
Server code uses a client without the cookies
A plain createClient() on the server has no way to read the user’s session, so getUser() returns this error even for a signed-in user. Use the server client from @supabase/ssr with the request’s cookies in API routes, Server Components and server actions. Our page on Supabase logging users out on refresh has the full setup.
02
The proxy is missing, misnamed or returns the wrong response
“An earlier response doesn't carry the refreshed cookies, so the user is signed out on the next request.” Supabase, Creating a Supabase client for SSR
Without the proxy, the session is never refreshed and the cookie runs out. On Next.js 15 and earlier the file must be middleware.ts. The proxy must also return the response that carries the refreshed cookies, or the next request has no session.
03
A call runs before the session has loaded
In the browser, the stored session loads after the page starts. Code that calls getUser() or updateUser() on first render, before sign-in or after sign-out, gets this error. Wait for the first onAuthStateChange event, or show a signed-out state when there is no session.
04
The password reset page has no session yet
We often see this on reset pages: updateUser() with the new password runs before the recovery link has been turned into a session, or the link opened in a different browser. Handle the PASSWORD_RECOVERY event, or exchange the link’s code first, then update the password.
05
Don’t hide the error with getSession()
“Never trust supabase.auth.getSession() inside server code such as Proxy. It reads the session out of the cookie without revalidating it.” Supabase, Creating a Supabase client for SSR
When fixing this, don’t switch server checks to getSession() just because it doesn’t throw. It trusts the cookie as it is. Protect pages with getClaims() or getUser().
Checked against the vendor’s docs on : Supabase docs: Creating a Supabase client for SSR; Supabase docs: Auth error codes.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.See scope and start
Related: Supabase logs users out on refresh · Supabase Invalid Refresh Token logouts · Supabase Email link is invalid or has expired · Supabase emails going to spam