AuthSessionMissingError: Auth session missing

A Supabase auth call needed a signed-in user, but the client making it had no session, often because it runs on the server without cookies.

Browser console or server logs
AuthSessionMissingError: Auth session missing!

Prompt to fix it

The app logs "AuthSessionMissingError: Auth session missing!". Find which Supabase auth call raises it and where that code runs. If it’s getUser() for a signed-out visitor, handle it as signed out instead of an error. If it runs on the server, switch to @supabase/ssr clients that read the session from cookies, and add the session refresh middleware if this is Next.js. If it’s the password reset page, exchange the link’s code for a session before calling updateUser. Don’t remove auth checks to make it go away.

Paste into Layerwise or any AI coding tool.

What it means

supabase-js raises this when a call that needs a signed-in user, such as getUser(), updateUser(), or refreshSession(), runs on a client that has no session stored. As far as that particular client knows, nobody is signed in.

For a signed-out visitor, that’s normal. getUser() returns user: null along with this error, so treat it as “show the sign-in screen” and keep it from crashing the page or filling your error tracker.

It’s a real bug when the person is signed in and the call still fails. The session lives in the browser, so a client created on the server with plain createClient can’t see it; server code needs @supabase/ssr, which reads the session from cookies. Password reset pages hit it too, when they call updateUser({ password }) before the reset link has been turned into a session.

Common causes

  • Server code, such as a Next.js route or server action, uses a Supabase client that doesn’t read the auth cookies.
  • getUser() runs for a visitor who isn’t signed in, and the code treats the error as a failure.
  • The password reset page calls updateUser before the link’s code has been exchanged for a session.
  • The session was cleared by signing out, or because its refresh token expired or was revoked.

How to fix it

  1. Decide whether the visitor should be signed in at this point. If not, check isAuthSessionMissingError(error) and show the signed-out state.
  2. On the server, create clients with createServerClient from @supabase/ssr, wired to the request’s cookies. In the browser, use createBrowserClient.
  3. In Next.js, add the session-refresh middleware from Supabase’s @supabase/ssr guide so the cookies stay current.
  4. On the password reset page, wait for the PASSWORD_RECOVERY event from onAuthStateChange, or call exchangeCodeForSession with the link’s code, before calling updateUser.
  5. Make sure sign-in and the failing call use the same Supabase project URL.

Example fix

import { isAuthSessionMissingError } from '@supabase/supabase-js';

const { data, error } = await supabase.auth.getUser();

if (isAuthSessionMissingError(error)) {
  // Nobody is signed in: show the sign-in screen.
  return null;
}
if (error) throw error;
return data.user;

Related errors

All errors
JWT expired

JWT expired

A request carried a sign-in token past its expiry time, usually because code saved the token once instead of using the refreshed one.

AuthApiError: Invalid login credentials

Invalid login credentials

Supabase couldn’t match that email and password to an account that signs in with a password, and it deliberately doesn’t say which part was wrong.

new row violates row-level security policy for table "todos"

New row violates row-level security policy

Postgres refused to save a row because no row-level security policy on that table lets the current user write it.

Access blocked: This app's request is invalid You can't sign in because this app sent an invalid request. You can try again later, or contact the developer about this issue. Error 400: redirect_uri_mismatch

Error 400: redirect_uri_mismatch

Google stopped the sign-in because the return address your app sent isn’t on the OAuth client’s list of approved redirect URIs.

Build with an agent that checks its work

The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.

DownloadRead the docs