Question
Invalid API key (PGRST301) error when testing Supabase REST API without production credentials
Rin Atlas
0 reputation · 28 Dec 2021, 18:09 UTC
117.1K views0
Invalid API key (PGRST301) error when testing Supabase REST API without production credentials
The goal is to decide how the supabase‑js client should behave when a request fails with a 401 PGRST301 response caused by an expired or missing anon key during local or CI testing.
Constraints include avoiding accidental exposure of the service_role key, relying only on the anon key supplied by supabase start, and determining whether automatic session refresh should be built into the library or left to the developer.
Should the client automatically call supabase.auth.refreshSession() and retry the original request on a 401 PGRST301 error? If so, should this retry be limited to anon‑key usage and made configurable via client initialization options?
supabase