Edge Function returns 401 Invalid JWT before execution (Verify JWT OFF, no logs)

[rahulramesh2305-arch]

Hi everyone 👋 I’m stuck with an Edge Functions issue and could really use some help.

TL;DR
Edge Function always returns 401 Invalid JWT BEFORE execution. Verify JWT is OFF. No logs. Auth + REST work fine.

Details:

• Supabase Edge Function: enter-matching
• Client: Flutter (Dart), Magic Link auth
• Error: 401 Invalid JWT
• Happens BEFORE function runs:
  • No console logs at all
  • Invocations are counted in dashboard
• Verify JWT is OFF
• Same behavior with:
  • supabase.functions.invoke(...)
  • raw HTTP POST to /functions/v1/enter-matching
• Minimal function (return { ok: true }) also fails
• Function redeployed multiple times

Headers sent on every request:

• Authorization: Bearer <access_token>
• apikey: <anon_key>
• Content-Type: application/json

What works:

• Auth (Magic Link) works
• PostgREST works with the same access token
• Session + JWT look valid

Observations:
This looks like the Edge Functions gateway rejecting the request before the function executes, not a bug in function code.

Questions:

1. Can Edge Functions return 401 Invalid JWT before execution even when Verify JWT is OFF?
2. Could recent Supabase maintenance affect Edge Functions auth/gateway only?
3. Could this be project-level corruption or config?
4. Would creating a new project be a reasonable workaround?

Happy to share project ref or screenshots if needed.
Thanks a lot 🙏

[aantti]

@kallebysantos

[kallebysantos]

Hi @rahulramesh2305-arch 💚
May you double check if this toggle is OFF on your dashboard:

Details

Also, look into your Config.toml file, there some other issues where the local config did overwrite the Platform on deploy.
So to avoid these problems I do recommend use the --no-verify-jwt flag while developing and deploying:

supabase functions deploy --no-verify-jwt

You can see all deploy options here.

[rahulramesh2305-arch]

Thanks for the pointer — confirmed, the Verify JWT toggle was ON. Turning it OFF fixed the issue immediately 👍
One follow-up question: do you know why this toggle sometimes turns ON automatically?
We didn’t explicitly enable it, so I’m trying to understand whether it can be triggered by redeploys, dashboard updates, or defaults during function edits.

[sunnypatell]

this is almost always caused by the supabase gateway verifying the JWT before it reaches your function, not by anything inside your function code.

what's happening:

when you call a supabase edge function, the API gateway checks the Authorization header against your project's JWT secret. if the token is expired, malformed, or signed with the wrong secret, the gateway returns a 401 before your function ever executes. this is why you see JWT expired even though your function code looks fine.

common causes and fixes:

1. anon key vs user JWT — if you're passing a user's JWT (from supabase.auth.getSession()), make sure it hasn't expired. supabase access tokens are short-lived (default 3600s). use supabase.auth.getSession() right before the call to get a fresh token, or better yet use the auto-refresh built into the client:

const { data: { session } } = await supabase.auth.getSession()

const { data, error } = await supabase.functions.invoke('my-function', {
  headers: {
    Authorization: `Bearer ${session.access_token}`
  }
})

2. service_role key for server-side calls — if you're calling from a backend/server context and don't need RLS, use the service_role key instead. it doesn't expire:

const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY)
const { data, error } = await supabase.functions.invoke('my-function')

3. local vs production mismatch — if this works locally with supabase functions serve but fails in production, your local setup might be using a different JWT secret. check that your .env or client initialization is pointing at the right project.

4. bypass gateway JWT verification — if your function handles its own auth (or is meant to be public), you can disable the gateway-level JWT check by setting verify_jwt = false in your config.toml:

[functions.my-function]
verify_jwt = false

docs ref: https://supabase.com/docs/guides/functions/auth

debugging tip: add a console.log('function invoked') at the top of your function. if you never see it in supabase functions logs, the gateway is rejecting the request before your function runs — confirming it's a JWT issue at the gateway level, not in your code.