How to Handle JWT Expiration in Supabase

1// The Supabase client handles auto-refresh internally.
2// When you create the client, auto-refresh is enabled by default:
3import { createClient } from '@supabase/supabase-js'
4
5const supabase = createClient(
6  process.env.NEXT_PUBLIC_SUPABASE_URL!,
7  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
8  {
9    auth: {
10      autoRefreshToken: true,  // default: true
11      persistSession: true,    // default: true
12    },
13  }
14)

1# JWT expiry is configured in the Dashboard:
2# Settings > Auth > Auth Settings > JWT Expiry
3#
4# Common values:
5# 900    = 15 minutes (high security)
6# 3600   = 1 hour (default, recommended)
7# 86400  = 24 hours (convenience, lower security)
8#
9# You can also set it via environment variable:
10# GOTRUE_JWT_EXP=3600

1import { createClient } from '@supabase/supabase-js'
2
3const supabase = createClient(
4  process.env.NEXT_PUBLIC_SUPABASE_URL!,
5  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
6)
7
8const { data: { subscription } } = supabase.auth.onAuthStateChange(
9  (event, session) => {
10    switch (event) {
11      case 'TOKEN_REFRESHED':
12        console.log('Token refreshed successfully')
13        // Optionally update any stored session data
14        break
15      case 'SIGNED_OUT':
16        console.log('User signed out or token refresh failed')
17        // Redirect to login page
18        window.location.href = '/login'
19        break
20      case 'SIGNED_IN':
21        console.log('User signed in', session?.user.email)
22        break
23    }
24  }
25)
26
27// Cleanup when component unmounts
28// subscription.unsubscribe()

1async function fetchDataWithRetry(tableName: string) {
2  const { data, error } = await supabase
3    .from(tableName)
4    .select('*')
5
6  if (error && error.message.includes('JWT expired')) {
7    // Token expired between refresh and request
8    const { error: refreshError } = await supabase.auth.refreshSession()
9
10    if (refreshError) {
11      // Refresh token also expired — user must re-authenticate
12      console.error('Session expired. Please log in again.')
13      window.location.href = '/login'
14      return null
15    }
16
17    // Retry the original request with the new token
18    const { data: retryData, error: retryError } = await supabase
19      .from(tableName)
20      .select('*')
21
22    if (retryError) throw retryError
23    return retryData
24  }
25
26  if (error) throw error
27  return data
28}

1// WRONG: getSession() does not verify the token
2// It may return an expired session that looks valid
3const { data: { session } } = await supabase.auth.getSession()
4// session.user may exist even if the JWT is expired!
5
6// CORRECT: getUser() verifies the token with the server
7const { data: { user }, error } = await supabase.auth.getUser()
8
9if (error || !user) {
10  // Token is expired or invalid — redirect to login
11  redirect('/login')
12}
13
14// Safe to proceed with authenticated operations
15const { data } = await supabase
16  .from('profiles')
17  .select('*')
18  .eq('id', user.id)
19  .single()