Skip to main content
wiring/supabase-env
check: wiring/supabase-env · error_code: E-AUTH-009 · doctor exits: 0

​
What you’re seeing

A warning: your composition wires the supabase() auth preset, and neither of the env names it verifies sessions with is set.

​
Why

Init detects the Supabase family from your dependencies — often a host that carries only the NEXT_PUBLIC_SUPABASE_* pair — but the preset verifies sessions server-side: SUPABASE_JWT_SECRET (HS256, offline) and/or SUPABASE_URL (ES256 logins via GoTrue’s JWKS). Without one, every static check passes and the first signed-in turn fails with “supabase() has no way to verify sessions”.

​
The fix

Add either name to .env.local (both is fine). For a Supabase Cloud project, SUPABASE_URL is the project URL and the JWT secret lives in the project’s API settings. For supabase start, use the local stack’s printed API_URL and JWT_SECRET. A warning, not a failure: production-only env kept outside your local files is legitimate — but then verify with a real signed-in turn where that env exists.
  • E-AUTH-001 — the live-probe face of the same gap: credentials that cannot be verified never reach the host API
  • E-AUTH-007 — the away-run seam (actAs) unconfigured, a different identity gap