Intermittent 403 "unrecognized JWT kid <nil> for algorithm ES256" on Admin API with valid sb_secret key

Open
#2,647 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Quiet
Tech stack
go
Domain
api, authentication, security

Research direction

Start with repeated GET /auth/v1/admin/users/{id} requests using the documented sb_secret key and compare successful and failing calls. Investigate Auth v2.193.1's gateway-to-auth JWT verification and key lookup across replicas. Done means valid admin requests no longer intermittently return the ES256 kid-nil 403.

Written by the indexing model from the issue text.

Description

Since 2026-07-22, GET /auth/v1/admin/users/{id} on our hosted project intermittently returns 403 with:

invalid JWT: unable to parse or verify signature, token is unverifiable: error while executing keyfunc: unrecognized JWT kid <nil> for algorithm ES256

Environment

  • Hosted Supabase project, ref btvisumxjqcpawtflxvh (eu-central), Auth version 2.193.1 (latest, per Infrastructure page)
  • Authorization: our sb_secret_… API key (not a JWT), sent via supabase-py (auth.admin.get_user_by_id)

Symptoms

  • ~1 in 6 calls fails; identical consecutive requests from a single process (same key, same target user, 1 s apart) yield mixed results, e.g. OK/OK/OK/FAIL/OK/OK.
  • Failures occur at all hours; first occurrence 2026-07-22, frequency increasing (on 2026-07-25 we saw 2 failures within 40 seconds: 08:35:02 and 08:35:36 UTC; also 08:05:02 UTC).
  • Onset coincides with the rollout window of Auth v2.193.1 / the v2.194.0 RCs (2026-07-22).

Config is clean and long-settled

  • Current signing key: ECC (P-256) with a proper kid; no standby key; no previously-used keys
  • Legacy HS256 shared secret: revoked ~4 months ago
  • No key or settings changes on our side in months

Why we believe this is platform-side
Our sb_secret_… key is not a JWT at all, so the ES256 token the keyfunc rejects cannot be the credential we sent — it appears to be minted inside the platform (gateway → auth exchange), and some replica/path signs or resolves it without a kid.

Happy to provide more timestamps or run diagnostics.

Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.