Supabase Edge Functions errorSupabase Edge Functions: 401 “Invalid JWT” or “Missing authorization header”

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why the function returns 401, and the fix

1. 01

   The request has no user token

   “If the header is missing, malformed, or signed with a different key, the platform returns a 401 error, and your code never executes.” Supabase docs, Authorization headers (verify_jwt)

   A plain fetch without headers, or a call made before the session loads, sends no user JWT. Use supabase.functions.invoke after sign-in, which adds the token for you.

2. 02

   A webhook or cron job calls it

   “Supabase now recommends turning off this built-in check and managing authentication directly in your function code, giving you more control over access.” Supabase docs, Edge Function 401 error response

   Stripe, cron and other servers don’t send a Supabase user token. Turn the check off for that one function, then verify the caller in code, such as the webhook signature or a secret key, or the function is open to anyone.

   # supabase/config.toml
   [functions.stripe-webhook]
   verify_jwt = false

3. 03

   The project uses the new signing keys

   “However, the legacy auth verification check only understands the legacy format.” Supabase docs, Edge Function 401 error response (Incompatible key format)

   Supabase’s troubleshooting guide says the built-in check can reject projects on the new asymmetric keys. Turn JWT verification off for that function in the dashboard, or redeploy with --no-verify-jwt, then check the caller in code.

4. 04

   An API key is sent as a Bearer token

   “Sending the wrong credential in the wrong header is the most common source of 401 errors.” Supabase docs, Authorization headers

   The new sb_publishable_ and sb_secret_ keys are not JWTs. The platform check lets them through, but a handler that verifies the header as a JWT returns its own 401. Put keys on the apikey header and keep Authorization for a signed-in user’s token.

5. 05

   Your own code returned the 401

   “If the response body contains a message you coded, or nothing at all, then your function code did execute and returned a 401 itself.” Supabase docs, Edge Function 401 error response

   A custom message or an empty body means the request passed the platform check. Look at the auth logic in your handler instead.

Checked against the vendor’s docs on November 9, 2026: Supabase docs: Authorization headers; Supabase docs: Securing Edge Functions; Supabase docs: Edge Function 401 error response.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Supabase Edge Function non-2xx status code · Supabase Edge Function CORS error · Supabase JWSError JWSInvalidSignature · Supabase Edge Function timeout