Error fixes / Supabase
Supabase
Supabase: Invalid API key
The key sent to Supabase is missing, truncated, or from another project.
The error
Invalid API key
What it means
Supabase rejected the apikey header. Common causes are a NEXT_PUBLIC or VITE variable that is empty in production, a key copied with a trailing space, or an anon key from a different project than the URL. It is not a sign to switch the browser over to the service role key.
Fix
- Compare the project URL and the anon key. They must come from the same Supabase project. In the dashboard they sit under Project Settings, API.
- On the host, open the environment variable that the client bundle reads. Empty values still build. Redeploy after you set them.
- Search the built JavaScript for the key only long enough to see whether it is the anon key. If you see the service role key, remove it and rotate it.
- Restart the local app after changing .env files. Preview servers keep the old value.
- If you rotated the key, update every host. A Vercel preview and the production environment are separate.
Prompt
Fix prompt
The Supabase client fails with "Invalid API key". Check the URL and the anon key are both set, from the same project, with no quotes or spaces in the env value. The browser must use the anon key, never the service role key. Find the env var names the client reads and list them for me. If a server-only key was referenced from client code, move that call to a server route. Do not print the key values.
Questions
Which key belongs in the browser?
The anon key, sometimes shown as the publishable key. It is public by design and must be paired with row level security. The service role key stays on the server.
It works locally and fails on the deployed site. Why?
The local env file is not deployed. Set the same variable names on the host for the production environment, then redeploy so the client bundle picks them up.
Does rotating the anon key fix a leaked service role key?
No. Rotate the key that leaked. Rotating the anon key only helps if the anon key itself was from the wrong project or was revoked.