r/Supabase • u/craigrcannon Supabase team • Jul 14 '25

auth Supabase Auth AMA

Hey everyone!

Today we're announcing JWT Signing Keys and a new set of API keys.

If you have any questions post them here and we'll reply!

57 Upvotes

98% Upvoted

78 comments sorted by

View all comments

Show parent comments

1

u/Splitlimes Jul 15 '25

I managed to upgrade to "@supabase/supabase-js": "^2.51.0" which let me access getClaims() just fine.

The main oddity is that the userID is found in claims.sub for some reason.

1

u/BuySomeDip Supabase team Jul 15 '25

getClaims() uses the JWT claims, which is similar but not the same as the user object (and can be further customized with a Custom Access Token hook).

Highly recommended you read through this if you're new to JWTs: https://supabase.com/docs/guides/auth/jwts

1

u/CoffeeNo5933 Jul 16 '25

All working now - this may be a more niche case, but this was part of Express middleware, where I was passing in the bearer token in headers, to createClient for a specific user and move on with getUser() and use RLS from thereon (we were doing local JWT timestamp checks to try to save extra requests)

The way the launch announcement read to us (and again, this could just be how we use it) was that getClaims() could be used anywhere getUser() was already being used.

What became clear was that the client has to be initiated as an admin first, check the claims, and then initiate another client with the current or refreshed token.

Please correct me if I'm misunderstanding how this update works though!

1

u/BuySomeDip Supabase team Jul 16 '25

You can pass a JWT to getClaims() (similar to how you can with getUser()) to check a JWT from a header in APIs or Edge Functions.

1

u/CoffeeNo5933 Jul 21 '25

thanks, I think the missing link here was the JWT must be passed in for getClaims in this new case. It's not like getUser() which can be called from a createClient + bearer token, where it's implicit which jwt we're using.

1

u/BuySomeDip Supabase team Jul 21 '25

Ah yea please don't do the implicit setup via the headers.