Skip to content
Get a quote

Supabase API errorSupabase: “Invalid API key”

Invalid API key is the Supabase error for a request whose apikey header holds no valid key for that project. Common causes are a wrong or stale key in the production build, a key from another project, and a key that no longer works for the project.

Short answer

Copy the publishable key and the URL from the same project’s API settings, set them in your host’s environment variables, and rebuild. If legacy keys were disabled or a key was rotated, move the app to the current publishable key. Send keys on the apikey header.

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why Supabase rejects the key, and the fix

  1. 01

    The production build has the wrong key

    Next.js, Vite and similar frameworks inline public env variables at build time. A key changed in Vercel or Netlify after the build keeps the old value until you rebuild. Check for stray quotes, spaces or a cut-off key too.

  2. 02

    The key was disabled or rotated

    “They stay valid until you disable them in the Settings > API Keys section of the Dashboard, which is a separate step.” Supabase docs, Understanding API keys

    An app that still ships the anon key stops working once legacy keys are disabled, and a rotated secret key fails everywhere the old one was copied. The exact message can differ, so check the API keys page for what is active. Switch to the current key.

  3. 03

    The URL and key come from different projects

    A staging key with the production URL, or the other way round, fails every request. Copy both values from the same project.

  4. 04

    The key is on the wrong header

    “Send publishable and secret keys on the apikey header, not on Authorization: Bearer.” Supabase docs, Understanding API keys (known limitations)

    The new keys are not JWTs. Send them on apikey, which supabase-js does for you, and keep Authorization for a user’s session token. Sent only as a Bearer token they fail with a different error, so check this when you call the REST API by hand.

Checked against the vendor’s docs on : Supabase docs: Understanding API keys.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
A buyer in the United States, July 2022. Shopify on Fiverr
All 127 Fiverr reviews

Related: Supabase JWSError JWSInvalidSignature · Supabase anon key exposed · Supabase Edge Function 401 Invalid JWT · Supabase Storage InvalidKey

Questions

More on this error

Are the anon and service_role keys going away?

Supabase is deprecating them by the end of 2026. Both key systems work at the same time, so move to publishable and secret keys before you disable the old ones.

Can I put the secret key in my frontend?

No. A secret key bypasses Row Level Security, and Supabase blocks it in browsers with a 401. Use the publishable key in anything you ship.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.

Describe your problem All fixes