Project affected by ongoing “401 errors due to JWT rejections” incident

[basilkat]

My Supabase project appears to be affected by the current incident listed on the Supabase status page concerning refreshed JWTs being rejected by the API.
Authentication succeeds and auth.getUser() succeeds, but PostgREST returns:
PGRST303: JWT issued at future
We performed a fresh refreshSession() and measured the resulting JWT:
deviceNowUtc: 2026-08-20T06:12:55Z
iatUtc: 2026-08-20T06:12:55Z
skewSeconds: 0
expUtc: 2026-08-20T07:12:55Z
The refreshed session succeeds, but an immediate Data API query still returns PGRST303: JWT issued at future.
Both development PC and physical iPhone have automatically synchronized clocks.

Can anyone advise if the JWT rejection fix has been rolled out?

[k1ng-arthur]

Fixes are currently being rolled out. If you are getting issues still then it's likely it just hasn't reached your project yet

[wfd2222]

I’m seeing what appears to be the same issue as of August 28, 2026 on a Supabase project in us-east-1.

Error: PGRST303: JWT issued at future

Supabase Auth successfully signs the user in, but immediately afterward Data API/PostgREST requests fail with JWT issued at future.

I have now reproduced this on two separate physical Windows PCs with fresh browser sessions.

Troubleshooting completed:

Windows automatic time synchronization enabled.
Client clock independently verified with time.is.
Fresh Supabase Auth sessions tested.
Multiple browsers tested.
Two separate physical PCs tested.
No custom JWT generation or modification.
RLS verified; authenticated policy permits the operation.
Waited more than 90 seconds after authentication before retrying.
A simple database insert still hangs/fails to complete.

The Supabase Data API itself is enabled and reachable. A direct request to /rest/v1/ reaches the Supabase gateway and returns the expected UNAUTHORIZED_MISSING_API_KEY response when called without credentials.

This appears very similar to the JWT/PostgREST timing issue discussed in this thread and does not appear to be caused by client clock skew.

I have also opened Supabase Support ticket SU-456830.

Is the JWT rejection fix fully deployed to us-east-1, and are there still projects experiencing this after the PostgREST fixes/rollout discussed above?

If useful, I can provide decoded iat, exp, iss, aud, and role claims from a freshly issued failing JWT privately. I will not post the full JWT publicly.