[Edge Functions] Invoking any Edge Function fails with 401 Unauthorized despite using valid service_role key

[bananamon423]

Hi everyone,

I'm pretty new to Supabase and have been trying to get Edge Functions to work, but I've run into a problem that I just can't seem to solve, and I would be so grateful for any help!

The Problem I'm Seeing:

No matter what I try, whenever I try to call my Edge Function, I get a 401 Unauthorized error that says {"error":{"message":"No auth credentials found","code":401}}.

This happens even when I try to use the service_role key, which I thought was supposed to have full access.

Here’s what I tried to do to make it as simple as possible:

I created a very basic "hello world" function just to test things out. Here is the code for it:

File: supabase/functions/hello-test/index.ts
Code:
TypeScript

import { serve } from "https://deno.land/std@0.177.0/http/server.ts"

serve(req => {
return new Response("Hello from my test function!", {
headers: { "Content-Type": "application/json" },
})
})
I deployed it using the CLI, which seemed to work fine.

Then I tried to call it from my terminal using this cURL command (with my actual service_role key put in place of the placeholder):

Bash

curl -i -X POST
-H "Authorization: Bearer YOUR_SERVICE_ROLE_KEY"
-H "apikey: YOUR_SERVICE_ROLE_KEY"
https://.supabase.co/functions/v1/hello-test
What I expected to happen:
I was hoping to see the "Hello from my test function!" message.

What actually happened:
Instead, I got the 401 Unauthorized error message. It feels like the function isn't even running, and the request is getting blocked before it gets there.

I've been trying to debug this for a while and have confirmed my keys and project URL are copied correctly. I'm really stuck and feel like I might be missing something simple.

Has anyone seen this kind of issue before? Any advice or suggestions would be amazing!

Thank you so much in advance.

[GAURAV-DEEP01]

I've had this problem but don't quite remember how I solved this and couldn't recreate it
What I do remember is going to the supabase dashboard and testing it using the test in there

To test if the function even runs i tried toggling off the JWT (its in details tab of that edge function) and tested that function

[bananamon423]

HI, attempted this in edge function and turned off the JWT verification, it gave me the same error. What I expected to happen:
I was hoping to see the "Hello from my test function!" message.

[GAURAV-DEEP01]

this is from the codebase

const JWT_SECRET = Deno.env.get('JWT_SECRET')
const VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'

function getAuthToken(req: Request) {
  const authHeader = req.headers.get('authorization')
  if (!authHeader) {
    throw new Error('Missing authorization header')
  }
  const [bearer, token] = authHeader.split(' ')
  if (bearer !== 'Bearer') {
    throw new Error(`Auth header is not 'Bearer {token}'`)
  }
  return token
}

async function verifyJWT(jwt: string): Promise<boolean> {
........
}

serve(async (req: Request) => {
  if (req.method !== 'OPTIONS' && VERIFY_JWT) {    <-------  401 is returned by the function only if this is true
    try {
      const token = getAuthToken(req)
      const isValidJWT = await verifyJWT(token)

      if (!isValidJWT) {
        return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {
          status: 401,
          headers: { 'Content-Type': 'application/json' },
        })
      }```
    } catch (e) {
      console.error(e)
      return new Response(JSON.stringify({ msg: e.toString() }), {
        status: 401,
        headers: { 'Content-Type': 'application/json' },
      })
    }
  }
......

This means that the VERIFY_JWT is not set to false even if you toggle off the Enforce JWT Verification
its either not being saved or there's an issue in supabase
i think this guy might know more about it @GaryAustin1

[marcin-amolkima]

I had a similar issue when calling an Edge Function from FlutterFlow. The problem turned out to be a small but critical mistake: I had two spaces in the Authorization header between "Bearer" and the token.

Interestingly, Supabase seems to tolerate this when you're calling database functions (RPC), but not when you're calling Edge Functions. I have the same Auhorization header for both cases and was wondering why rpc works and edge doesn't.

This small typo cost me a lot of time, so I hope this helps someone avoid the same rabbit hole!

[bqwabi]

Hey guys I figured it out , your Bearer in your request header is supposed to be your supabase anon key, you can find your supabase anon key localy by just creating a function like supabase functions new hello-world it will be in a comment at the bottom of the file, I tried other ways to find it like using supabase status and supabase secrets list I couldnt get it

[iice257]

The service role key gives database privileges inside your code, but it does not automatically bypass Edge Function JWT verification at the gateway. If the function has JWT verification enabled, the request still needs an Authorization: Bearer ... header before your function runs. For a public test function, set verify_jwt = false under that function in supabase/config.toml, redeploy, then use the service role key only inside server-side code or secrets. Do not expose the service role key from a browser/client.