local supabase edge functions runtime does not work properly - a publishable key is not read properly

[pkawula]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Supabase edge function doesn't work in local environment

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Create a local db using an example from docs: https://supabase.com/docs/guides/functions/quickstart
2. Run your function
3. Try to access it with curl (or postman)
4. There's error: {"msg":"Error: Missing authorization header"}

Expected behavior

A function should run.

Screenshots

Not applicable

System information

• OS: macOS (latest)
• Browser (if applies) [e.g. chrome, safari]
• Version of supabase: 2.67.1 (cli)
• Version of Node.js: 22.14.0

Additional context

I tried running it with postman and curl in many forms and nothing works

When I run a curl as:

curl -i -X POST http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Content-Length: 45
Connection: keep-alive
vary: Accept-Encoding
date: Wed, 31 Dec 2025 14:06:42 GMT
Access-Control-Allow-Origin: *
X-Kong-Upstream-Latency: 9
X-Kong-Proxy-Latency: 1
Via: kong/2.8.1

{"msg":"Error: Missing authorization header"}

If with random auth header:

curl -i -X POST http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders \
-H 'Authorization: sdasdasa'
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Content-Length: 52
Connection: keep-alive
vary: Accept-Encoding
date: Wed, 31 Dec 2025 14:07:00 GMT
Access-Control-Allow-Origin: *
X-Kong-Upstream-Latency: 10
X-Kong-Proxy-Latency: 1
Via: kong/2.8.1

{"msg":"Error: Auth header is not 'Bearer {token}'"}

if with proper publishable key:

curl -i -X POST http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders \
-H 'Authorization: Bearer sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH'
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Content-Length: 45
Connection: keep-alive
vary: Accept-Encoding
date: Wed, 31 Dec 2025 14:07:24 GMT
Access-Control-Allow-Origin: *
X-Kong-Upstream-Latency: 2
X-Kong-Proxy-Latency: 1
Via: kong/2.8.1

{"msg":"Error: Missing authorization header"}

Additional logs from the supabase functions serve command:

Setting up Edge Functions runtime...
2025-12-31T14:29:57.066972340Z Serving functions on http://127.0.0.1:54321/functions/v1/<function-name>
2025-12-31T14:29:57.067093673Z  - http://127.0.0.1:54321/functions/v1/dispatch-due-reminders
2025-12-31T14:29:57.067097173Z  - http://127.0.0.1:54321/functions/v1/hello-world
2025-12-31T14:29:57.067100132Z  - http://127.0.0.1:54321/functions/v1/schedule-weekly-reminders
2025-12-31T14:29:57.067101048Z Using supabase-edge-runtime-1.69.28 (compatible with Deno v2.1.4)
2025-12-31T14:30:04.622310802Z Error: Missing authorization header
2025-12-31T14:30:04.622357927Z     at getAuthToken (file:///var/tmp/sb-compile-edge-runtime/root/index.ts:83:11)
2025-12-31T14:30:04.622361052Z     at Object.handler (file:///var/tmp/sb-compile-edge-runtime/root/index.ts:139:23)
2025-12-31T14:30:04.622362052Z     at mapped (ext:runtime/http.js:231:42)
2025-12-31T14:30:04.622362760Z     at respond (ext:runtime/http.js:339:14)
2025-12-31T14:30:04.622363427Z     at handleHttp (ext:runtime/http.js:160:9)
2025-12-31T14:30:04.622364094Z     at eventLoopTick (ext:core/01_core.js:175:7)

[aantti]

@pkawula The key should be part of the apikey header.

[pkawula]

thanks @aantti
this got me to think about the headers and after a short research I found: https://supabase.com/docs/guides/api/api-keys#known-limitations-and-compatibility-differences
Here's description to use --no-verify-jwt flag while using supabase functions serve locally because publishable keys behaves differently than the old ANON keys.

I think this should be fixed in the docs for the functions quickstart so leaving the issue open

[kallebysantos]

Hi @pkawula 💚

I think it should be fixed in the docs...

Sure!! I'm already working on it PR #41444
Hope to finish it soon 🤞

[github-actions]

🔕 This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days.