Fix · Supabase and databases

"Invalid API key" or 401 from Supabase

Blocks your workSecurity

What you may see

Every request from my app answers 401
It started after I changed or copied the keys

Most likely cause

The key is missing, copied with a space or a line break, belongs to another project, or was rotated.

Check first (about two minutes)

Check the project address and the key are from the SAME project (the same short project id in the address).
Check for a space or line break at the start or end of the saved variable value.

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a careful senior engineer who knows Supabase (database, login and file storage) and explains it to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

THE PROBLEM
"Invalid API key" or 401 from Supabase

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
The key is missing, copied with a space or a line break, belongs to another project, or was rotated.

DO THESE STEPS, IN THIS ORDER
1. List which variable names the app reads for the address and key (names only).
2. Check the code uses the public key for the browser and that the same names exist in the host's settings for the right environment.
3. Tell me how to copy the keys again from the project's API settings page (it may be labelled differently), re-save them, and redeploy.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- A request with the public key returns data or a normal permission answer, not 401.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not print the key to check it.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

List which variable names the app reads for the address and key (names only).
Check the code uses the public key for the browser and that the same names exist in the host's settings for the right environment.
Tell me how to copy the keys again from the project's API settings page (it may be labelled differently), re-save them, and redeploy.

Do not do this

Do not paste keys into chat.
Do not print the key to check it.

Try another entry