Realtime crash on realtime publish

[quick691fr]

Describe the bug

When I publish a message on my realtime channel on local dev environment, the realtime container crash with error :

Server: realtime-dev:4000 (http)

Request: POST /api/broadcast

** (exit) an exception was raised:

    ** (MatchError) no match of right hand side value: [""]

        (realtime 2.41.23) lib/realtime_web/plugs/auth_tenant.ex:45: RealtimeWeb.AuthTenant.access_token/1

        (realtime 2.41.23) lib/realtime_web/plugs/auth_tenant.ex:21: RealtimeWeb.AuthTenant.call/2

        (realtime 2.41.23) RealtimeWeb.Router.secure_tenant_api/2

        (realtime 2.41.23) lib/realtime_web/router.ex:1: RealtimeWeb.Router.__pipe_through7__/1

        (phoenix 1.7.19) lib/phoenix/router.ex:475: Phoenix.Router.__call__/5

        (realtime 2.41.23) lib/realtime_web/endpoint.ex:1: RealtimeWeb.Endpoint.plug_builder_call/2

        (realtime 2.41.23) lib/realtime_web/endpoint.ex:1: RealtimeWeb.Endpoint.call/2

        (plug_cowboy 2.7.2) lib/plug/cowboy/handler.ex:11: Plug.Cowboy.Handler.init/2

14:06:11.428 request_id=GGoUhkklB6I0oeQAAC3h project=realtime-dev external_id=realtime-dev [info] Sent 500 in 3ms

14:06:11.429 [error] #PID<0.3679.0> running RealtimeWeb.Endpoint (connection #PID<0.3671.0>, stream id 5) terminated

I tried recreating environment with supabase stop --no-backup but stil get the same result.

It seems happening since I updated supabase/supabase-js library to 2.58.0.

To Reproduce
Steps to reproduce the behavior:

1. Create environment with supabase create
2. Publish a message to a realtime custom channel with supabase/supabase-js library
3. Check out the logs of realtime container

Expected behavior
Realtime channel pushing message to subscribers

System information
Rerun the failing command with --create-ticket flag.

• Ticket ID: Couldn't get one
• Version of OS: Windows 11
• Version of CLI: v2.47.2
• Version of Docker: Docker version 28.2.2, build e6534b4
• Versions of services: [output from supabase services command]

  SERVICE IMAGE          | LOCAL                  | LINKED
  ------------------------|------------------------|------------
   supabase/postgres      | 15.8.1.073             | 15.8.1.073
   supabase/gotrue        | v2.179.0               | v2.179.0
   postgrest/postgrest    | v12.2.3                | v12.2.3
   supabase/realtime      | v2.41.23               | -
   supabase/storage-api   | v1.26.3                | -
   supabase/edge-runtime  | v1.68.3                | -
   supabase/studio        | 2025.08.04-sha-6e99ca6 | -
   supabase/postgres-meta | v0.91.5                | -
   supabase/logflare      | 1.18.3                 | -
   supabase/supavisor     | 2.6.1                  | -

Additional context

• Version of supabase-js : 2.58.0
• Version of Node.js : v20.10.0

[quick691fr]

I updated CLI to latest version 2.47.2 and got the same error with much verbosity :

SERVICE IMAGE          | LOCAL                  | LINKED     
  ------------------------|------------------------|------------
   supabase/postgres      | 15.8.1.073             | 15.8.1.073 
   supabase/gotrue        | v2.179.0               | v2.179.0   
   postgrest/postgrest    | v12.2.3                | v12.2.3    
   supabase/realtime      | v2.51.3                | -
   supabase/storage-api   | v1.27.6                | -
   supabase/edge-runtime  | v1.69.12               | -
   supabase/studio        | 2025.09.23-sha-081a753 | -
   supabase/postgres-meta | v0.91.6                | -
   supabase/logflare      | 1.22.3                 | -
   supabase/supavisor     | 2.7.0                  | -

17:43:22.786 [error] Ranch listener RealtimeWeb.Endpoint.HTTP, connection process #PID<0.3876.0>, stream 1 had its request process #PID<0.3877.0> exit with reason {{{%MatchError{

     term: [""]

   },

   [

     {RealtimeWeb.AuthTenant,

      :access_token,

      1,

      [

        file: ~c"lib/realtime_web/plugs/auth_tenant.ex",

        line: 46

      ]},

     {RealtimeWeb.AuthTenant,

      :call,

      2,

      [

        file: ~c"lib/realtime_web/plugs/auth_tenant.ex",

        line: 21

      ]},

     {RealtimeWeb.Router,

      :secure_tenant_api,

      2,

      []},

     {RealtimeWeb.Router,

      :__pipe_through7__,

      1,

      [

        file: ~c"lib/realtime_web/router.ex",

        line: 1

      ]},

     {Phoenix.Router,

      :__call__,

      5,

      [

        file: ~c"lib/phoenix/router.ex",

        line: 475

      ]},

     {RealtimeWeb.Endpoint,

      :plug_builder_call,

      2,

      [

        file: ~c"lib/realtime_web/endpoint.ex",

        line: 1

      ]},

     {RealtimeWeb.Endpoint,

      :call,

      2,

      [

        file: ~c"lib/realtime_web/endpoint.ex",

        line: 1

      ]},

     {Plug.Cowboy.Handler,

      :init,

      2,
      [

        file: ~c"lib/plug/cowboy/handler.ex",

        line: 11

      ]}

   ]},

  {RealtimeWeb.Endpoint,

   :call,

   [

     %Plug.Conn{

       adapter: {Plug.Cowboy.Conn,

        :...},

       assigns: %{},

       body_params: %Plug.Conn.Unfetched{

         aspect: :body_params

       },

       cookies: %Plug.Conn.Unfetched{

         aspect: :cookies

       },

       halted: false,

       host: "realtime-dev",

       method: "POST",

       owner: #PID<0.3877.0>,

       params: %Plug.Conn.Unfetched{

         aspect: :params

       },

       path_info: ["api",

        "broadcast"],

       path_params: %{},

       port: 4000,

       private: %{},

       query_params: %Plug.Conn.Unfetched{

         aspect: :query_params

       },

       query_string: "",

       remote_ip: {0,

        0,

        0,

        0,

        0,

        65535,

        44055,

        5},

       req_cookies: %Plug.Conn.Unfetched{

         aspect: :cookies

       },

       req_headers: [

         {"accept",

          "*/*"},

         {"accept-encoding",

          "gzip, deflate"},

         {"accept-language",

          "*"},
         {"apikey",

          "**************************************************"},

         {"authorization",

          ""},

         {"connection",

          "keep-alive"},

         {"content-length",

          "123"},

         {"content-type",

          "application/json"},

         {"host",

          "realtime-dev:4000"},

         {"sec-fetch-mode",

          "cors"},

         {"user-agent",

          "node"},

         {"x-forwarded-for",

          "172.23.0.1"},

         {"x-forwarded-host",

          "host.docker.internal"},

         {"x-forwarded-path",

          "/realtime/v1/api/broadcast"},

         {"x-forwarded-port",

          "55321"},

         {"x-forwarded-prefix",

          "/realtime/v1/api"},

         {"x-forwarded-proto",

          "http"},

         {"x-real-ip",

          "172.23.0.1"}

       ],

       request_path: "/api/broadcast",

       resp_body: nil,

       resp_cookies: %{},

       resp_headers: [

         {"cache-control",

          "max-age=0, private, must-revalidate"}

       ],

       scheme: :http,

       script_name: [],

       secret_key_base: nil,

       state: :unset,

       status: nil

     },

     []

   ]}},

 []}

[quick691fr]

Seems coming from supabase-js library with issue : supabase/supabase-js#1561