SupabaseAuthNext.js

Supabase: Auth session missing!

AuthSessionMissingError: Auth session missing!

In short: The Supabase client that ran this call didn't have the user's session, usually because the server client wasn't given the request cookies.

Why it happens

Calls that need a logged-in user (updateUser, refreshSession, some getUser paths, or a server helper you wrote) throw Auth session missing! when the client has no session. In the Next.js App Router this is almost always a client mix-up: a Server Component, route handler, or server action used the browser client (createClient from @supabase/supabase-js) instead of createServerClient from @supabase/ssr with a cookie adapter. The other common cause is missing middleware (or proxy.ts in Next.js 16+) that refreshes the auth cookies on each request, so the server never sees a session even though the browser is signed in.

How to fix it

1. In Server Components, route handlers, and server actions, use createServerClient from @supabase/ssr. Pass cookies() from next/headers with getAll and setAll. In Next.js 15+, cookies() is async: const cookieStore = await cookies().
2. Use createBrowserClient only inside Client Components ("use client").
3. Add the Supabase session-refresh middleware (or proxy.ts) from the Supabase Next.js docs so tokens are written back to cookies on each request.
4. Call const { data: { user } } = await supabase.auth.getUser() on the server client before any code that assumes someone is signed in.
5. After deploy, confirm Authentication → URL Configuration includes your production site URL and redirect URLs, and that the server is using the same Supabase project as the browser.

Example

import { createServerClient } from "@supabase/ssr";
import { cookies } from "next/headers";

export async function createClient() {
  const cookieStore = await cookies();
  return createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,
    {
      cookies: {
        getAll: () => cookieStore.getAll(),
        setAll: (cookiesToSet) => {
          try {
            cookiesToSet.forEach(({ name, value, options }) =>
              cookieStore.set(name, value, options)
            );
          } catch {
            // setAll throws in Server Components; middleware writes the cookies instead.
          }
        },
      },
    }
  );
}

Copy-paste fix prompt

I'm getting this error in my app:

AuthSessionMissingError: Auth session missing!

[Paste the full error, stack trace, and the file it points to here]

Likely cause: The Supabase client that ran this call didn't have the user's session, usually because the server client wasn't given the request cookies.

Task: Find every place a Supabase client is created. Use createServerClient from @supabase/ssr with the Next.js cookie adapter on the server, createBrowserClient only in Client Components, and add session-refresh middleware. Don't use the secret key to skip auth.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, v0, Lovable, Bolt. Last reviewed 2026-11-15.