How to create a custom JWT for authentication

[samlown]

We're migrating from Firebase to Supabase and are having difficulties around custom JWT for authentication. We're not using Supabase Auth. In firebase this was pretty straight forward: from the backend we call the Go CustomTokenWithClaims method to generate a new JWT with some custom data that would then be checked before granting access to the data. Easy peasy.

With supabase I've not been able to find the equivalent, only examples when using Auth, which we're not. We've tried creating a JWT manually with the following claims and signed using HS256 with the JWT Secret from supabase:

	claims := map[string]any{
		"role": "authenticated",
		"sub":  profile.User.ID,
		"iat":  time.Now().Unix(),
		"exp":  time.Now().Add(supabaseJWTDuration).Unix(),
	}

With no luck. Has anyone done something similar? Is there another way to achieve this? Thanks.

[GaryAustin1]

Are you using the jwt in the Authorization header and the normal anon key in the apikey header?
https://supabase.com/docs/learn/auth-deep-dive/auth-deep-dive-jwts#jwts-in-supabase

What does no luck mean?

[GaryAustin1]

You should respond to the comments rather than start a new one.

Your custom jwt has to go in the authenticated header, not the apikey. The apikey should be the anon one. If supabase_jwt is your custom jwt that is not the place to put it.

https://supabase.com/docs/reference/javascript/initializing?example=with-additional-parameters

You add Authorization header with the header option. The Authorization header needs to be Bearer my_custom_jwt.

Also from my first link above:

[samlown]

Sorry, I thought I did! I'll repost the previous comment here and delete the previous for consistency:

I'm trying to use a JWT in the frontend generated by the backend, so the client is the standard JS one:

const supabase = createClient(setupInfo.supabase_url, setupInfo.supabase_jwt)

The specific error message generated is:

{message: 'Invalid API key', hint: 'Double check your Supabase `anon` or `service_role` API key.'}

I'll try using the additional header option in the client. Thanks

[samlown]

Okay, so that appears to be working now, this is the JS we needed:

const opts = {
  global: {
    headers: {
      Authorization: `Bearer ${setupInfo.supabase_jwt}`
    }
  }
 }
const supabase = createClient(setupInfo.supabase_url, setupInfo.supabase_anon_key, opts)

const { data, error } = await supabase.from('companies').select() // random query

Thanks!