local supabase edge functions runtime does not work properly - a publishable key is not read properly

[pkawula]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Supabase edge function doesn't work in local environment

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Create a local db using an example from docs: https://supabase.com/docs/guides/functions/quickstart
2. Run your function
3. Try to access it with curl (or postman)
4. There's error: {"msg":"Error: Missing authorization header"}

Expected behavior

A function should run.

Screenshots

Not applicable

System information

• OS: macOS (latest)
• Browser (if applies) [e.g. chrome, safari]
• Version of supabase: 2.67.1 (cli)
• Version of Node.js: 22.14.0

Additional context

I tried running it with postman and curl in many forms and nothing works

When I run a curl as:

curl -i -X POST http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Content-Length: 45
Connection: keep-alive
vary: Accept-Encoding
date: Wed, 31 Dec 2025 14:06:42 GMT
Access-Control-Allow-Origin: *
X-Kong-Upstream-Latency: 9
X-Kong-Proxy-Latency: 1
Via: kong/2.8.1

{"msg":"Error: Missing authorization header"}

If with random auth header:

curl -i -X POST http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders \
-H 'Authorization: sdasdasa'
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Content-Length: 52
Connection: keep-alive
vary: Accept-Encoding
date: Wed, 31 Dec 2025 14:07:00 GMT
Access-Control-Allow-Origin: *
X-Kong-Upstream-Latency: 10
X-Kong-Proxy-Latency: 1
Via: kong/2.8.1

{"msg":"Error: Auth header is not 'Bearer {token}'"}

if with proper publishable key:

curl -i -X POST http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders \
-H 'Authorization: Bearer sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH'
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Content-Length: 45
Connection: keep-alive
vary: Accept-Encoding
date: Wed, 31 Dec 2025 14:07:24 GMT
Access-Control-Allow-Origin: *
X-Kong-Upstream-Latency: 2
X-Kong-Proxy-Latency: 1
Via: kong/2.8.1

{"msg":"Error: Missing authorization header"}

Additional logs from the supabase functions serve command:

Setting up Edge Functions runtime...
2025-12-31T14:29:57.066972340Z Serving functions on http://127.0.0.1:54321/functions/v1/<function-name>
2025-12-31T14:29:57.067093673Z  - http://127.0.0.1:54321/functions/v1/dispatch-due-reminders
2025-12-31T14:29:57.067097173Z  - http://127.0.0.1:54321/functions/v1/hello-world
2025-12-31T14:29:57.067100132Z  - http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders
2025-12-31T14:29:57.067101048Z Using supabase-edge-runtime-1.69.28 (compatible with Deno v2.1.4)
2025-12-31T14:30:04.622310802Z Error: Missing authorization header
2025-12-31T14:30:04.622357927Z     at getAuthToken (file:///var/tmp/sb-compile-edge-runtime/root/index.ts:83:11)
2025-12-31T14:30:04.622361052Z     at Object.handler (file:///var/tmp/sb-compile-edge-runtime/root/index.ts:139:23)
2025-12-31T14:30:04.622362052Z     at mapped (ext:runtime/http.js:231:42)
2025-12-31T14:30:04.622362760Z     at respond (ext:runtime/http.js:339:14)
2025-12-31T14:30:04.622363427Z     at handleHttp (ext:runtime/http.js:160:9)
2025-12-31T14:30:04.622364094Z     at eventLoopTick (ext:core/01_core.js:175:7)

[aantti]

@pkawula The key should be part of the apikey header.

[pkawula]

thanks @aantti
this got me to think about the headers and after a short research I found: https://supabase.com/docs/guides/api/api-keys#known-limitations-and-compatibility-differences
Here's description to use --no-verify-jwt flag while using supabase functions serve locally because publishable keys behaves differently than the old ANON keys.

I think this should be fixed in the docs for the functions quickstart so leaving the issue open

[kallebysantos]

Hi @pkawula 💚

I think it should be fixed in the docs...

Sure!! I'm already working on it PR #41444
Hope to finish it soon 🤞

[github-actions]

🔕 This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days.

[kallebysantos]

Hey @pkawula,
The api keys are already integrated with self-host setup, see New API Keys and Asymmetric Authentication.

A disclaimer is that sb_publishable as well sb_secrets are not compatible with the verifyJwt feature.
This because, differently from legacy ANON_KEY, both new Api Keys are "random string" values instead of valid JWTs.
It means that during a function request you must send this keys inside apiKey header instead of Authorization — This last one only should be used for user access tokens, in order to apply RLS policy scope.

In this case you should keep verify_jwt=false and then do manually* string comparison. If you're self-hosting, you can also customise this behaviour on main/index.ts file.

*We should have a better approach very soon