Guide
Supabase Edge Function returns 401: Invalid JWT or Missing authorization header
Updated
A 401 from a Supabase Edge Function can come from the built-in JWT check that runs before your code, or from your own function code, so check the response body first. This applies to apps made with AI app builders such as Lovable, Bolt, Base44, Replit or v0 when the app uses Supabase as its backend. Supabase now recommends turning the built-in check off and handling authentication in your function code.
Fixed in your code, then tested live. Check my app free
Why it happens
Every request to an Edge Function passes through a platform-level check before your code executes. When that check is on and the Authorization header is missing, malformed, or signed with a different key, the platform returns a 401 and your code never runs. A 401 can also be returned by your own function code, in which case the function did run.
Possible causes
- The built-in JWT check is on and the key sent does not match your project's keys.
- Your project uses the new asymmetric keys, but the legacy check only understands the legacy format.
- The request has no Authorization header at all, which the check rejects when it is on.
- A credential was sent in the wrong header: user tokens belong in Authorization and API keys belong in apikey.
- Your own function code ran and returned a 401 itself, for example from a third-party API response.
Official fix steps
- Check the response body: "Invalid Token or Protected Header formatting", "Invalid JWT" or "Missing authorization header" means the built-in check failed. (supabase.com)
- If the body has a message you coded or is empty, your function ran and returned the 401 itself. (supabase.com)
- In the Functions Dashboard, open the affected function's detail tab and toggle off JWT verification. (supabase.com)
- Or redeploy the function from the Supabase CLI with the no-verify-jwt flag. (supabase.com)
- Know that turning the check off removes the platform's check, so your own function code becomes the only thing that verifies the caller. (supabase.com)
- If you keep the check on, send a valid legacy API key with the Supabase client library. (supabase.com)
- Put API keys in the apikey header and reserve Authorization for user tokens. (supabase.com)
You can't see it yourself
You're signed in, your customers aren't. While you are signed in, your requests carry your session token. With the check on, the platform expects a valid user JWT in the Authorization header, and if it is missing, malformed, or signed with a different key, the platform returns a 401 before your code runs. That means a caller without a valid token can get a result you never see yourself.
What to do next
App broke after you published it? Our AI agent fixes it in your code, then tests your live app again so you see the result yourself. The first check is free.
Fixed in your code, then tested live. Check my app free
Related: Supabase legacy API keys are going away: will your app break? · Supabase "permission denied for table" (42501) fix
Sources
VibeFix's free check can show this on your live app: our AI agent tries your live app like a new user and shows you what breaks. On request, it reviews your code independently (VibeFix isn't part of any app builder), fixes it in your code and re-checks it live.
Last checked: 7 November 2026, against the sources listed above.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.
Want it fixed?
Our AI agent fixes it in your code and tests your live app again. See pricing.
It starts with a free check that confirms the problem on your live app, no account needed.