Can't change JWT secret on self-hosted Supabase instance

[ghost]

I'm a bit confused. I changed the JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY in the .env file and restarted Supabase using Docker Compose as described in documentation:

Update API Keys: Use the JWT secret to generate new anon and service API keys. Replace the existing keys in your .env file with the new ones.
Restart Services: After updating your secrets and keys, restart all services to apply the changes. This is essential for the new configurations to take effect.

However, the old JWT tokens (both anon and user's) are still valid. Do the .env variables only get used once to initialize the database and some internal states? Is there a way to update the JWT Secret?

[heblol]

Same problem here. Starting up using supabase start, with an adjusted .env file, but it does not use the JWT_SECRET.

Looking for it now multiple days. Dont get it.

[komposer-aml]

Did you ever find a fix? I've spent a whole hour on something that should've been as simple as changing the value of something in a config file

[Oliver-Turp]

Did you ever find a fix? I've spent a whole hour on something that should've been as simple as changing the value of something in a config file

Did you ever fix it? I've spent two days trying to get some self hosted version working. I'm a few hours from calling it quits and trying other programmes...

[komposer-aml]

Oliver! Apologies for not seeing your message and responding sooner. I hope this helps someone else if it doesn't help you. The docs don't cover all the nuance.

All you have to do is rename the .env file to .env.local. Make sure it isn't in the supabase directory with config.toml, seed.sql, and migrations - in the directory that directly contains the supabase folder, not inside it.

If that doesn't work, try going to these Supabase docs and scrolling down to the randomly generated JWT Secret, anon, and public keys. It'll look like the screenshot below

Use the values it generates.

If neither of those 2 things work, I don't mind looking through more of my notes. Just let me know (that goes to anyone else finding this message)

[icarus-sullivan]

I'm still in the testing phase of supabase so I have only been running things in a sparse manner with a single table. I updated my JWT_SECRET and it was not automatically picked up by the docker services. How I fixed this was by doing the following:

• I made sure I had a valid JWT_SECRET and that I generated both an ANON_KEY and SERVICE key here.

• Open the SQL Editor, for me its here. Then copy+paste the following and run it.

ALTER DATABASE postgres SET "app.settings.jwt_secret" TO "<your_secret_here>";

• Run docker compose down (WARNING: This removes your services!!!)

• Update my .env file with my new secrets

• Run docker compose up -d

[aurelioo]

This works for me, thanks!

[OpenSourceLasagna]

Thank you! To display the currently active secret you can use: SHOW app.settings.jwt_secret; and besides that, the max. allowed length is 63 characters or else the secret will be cut off and will of course not work :)