Functions createClient issue when using legacy tokens in local docker

[MathieuUrstein]

Bug report

Describe the bug

After updating supabase from 2.67 to 2.72 the createClient function in edge functions (documented here) fails locally. Still works in production though.

By failing here is the console error message: TypeError: Key for the ES256 algorithm must be of type CryptoKey. Received an instance of Uint8Array.

To reproduce

• Start a local docker version of supabase 2.72 or later
• Try creating a supabase client like so:

export const supabaseAdmin = createClient(
  Deno.env.get("SUPABASE_URL") || "",
  Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") || ""
)
const getSupabaseUserClient = (request: Request) =>
  createClient(
    Deno.env.get("SUPABASE_URL") || "",
    Deno.env.get("SUPABASE_ANON_KEY") || "",
    // Create client with Auth context of the user that called the function.
    {
      global: {
        headers: { Authorization: request.headers.get("Authorization") },
      },
    }
  )

Deno.serve(async (request: Request) => {
   getSupabaseUserClient(request)
   supabaseAdmin()
})

• run the function and you should have the error

---

My guess is that the default provided environment variables like SUPABASE_SERVICE_ROLE_KEY or SUPABASE_ANON_KEY have been updated but are now not compatible with supabase-js.

I've also seen a new documentation here but it does not seem to talk about impersonated clients.

Might be related to supabase/supabase#42037

[aantti]

@kallebysantos fyi

[kallebysantos]

Hi @MathieuUrstein 💚
The the default api keys/tokens did changed for local development.

Please, consider following this guide to secure your functions.
I do also suggest this medium blog post from a community user

[MathieuUrstein]

Hello @kallebysantos thanks for helping.
The supabase documentation you linked indeed covers how to handle the new tokens except for the impersonated clients part.

Previously the old documentation was stating how to enforce RLS relatively to the user who called the function. The new documentation does not provide an equivalent. Those default environment variables seems to still be present and unchanged on Supabase production services, it would be great to bring them back on the Docker dev environments.

[kallebysantos]

Hi @MathieuUrstein 💚
The docs are divided in two parts:

1. Supabase Auth integration:
   You should use this one to validate users / extract user metadata.
   Be aware that you need to manually add the SB_PUBLISHABLE_KEY as new secret – we didn't expose it yet 😕

2. JWT Verification:
   Use this one when you just need to verify an authorized request without explicit consume the user metadata.
   You can also use this approach when integrating with custom oAuth providers like Clerk

We are still working to improve the DX of this 🙏