Common errors · Supabase Auth (Lovable, Bolt, Next.js, any supabase-js v2 client)

Supabase Auth session missing: where the session got lost

Cause The recovery code was never exchanged for a session, or server code uses a client that cannot read the browser cookies.
Fix Exchange the code before updating the password, and build server clients from the request cookies with @supabase/ssr.

Have it fixed for you, 290 EURSee the fix step by step

supabase-js throws this when a call needs a signed-in user (getUser, updateUser, signOut) and the client holds no session. In generated apps it shows up most on the reset password page and in server code: the user did click the link, but the session never reached the client that makes the call.

Where it breaks

Which case is yours?

1. Reset password page: updateUser({ password }) runs before the client has read the recovery link. With the PKCE flow the link carries ?code= and nothing creates the session until that code is exchanged.
2. Server side (Next.js route handlers, server components, server actions): a plain createClient() has no access to the browser cookies, so on the server every user looks signed out.
3. The email link points to another origin (localhost, a preview URL) because that URL is missing from the allowed redirect URLs: the session is created there, not on your production domain.
4. getUser() on a page that visitors open while signed out: the error is the normal answer, but the app treats it as a crash instead of a signed-out state.

The fix, step by step

1. On the reset password page, wait for the recovery session before showing the form. With PKCE, exchange the code from the URL first.

   const code = new URLSearchParams(location.search).get("code");
   if (code) await supabase.auth.exchangeCodeForSession(code);
   
   supabase.auth.onAuthStateChange((event) => {
     if (event === "PASSWORD_RECOVERY") setReady(true);
   });

2. Only then update the password, and stop on the error instead of assuming success.

   const { error } = await supabase.auth.updateUser({ password });
   if (error) throw error;

3. In server code, build the client from the request cookies with @supabase/ssr, never with the browser client.

   import { createServerClient } from "@supabase/ssr";
   import { cookies } from "next/headers";
   
   const store = await cookies();
   const supabase = createServerClient(URL, ANON_KEY, {
     cookies: {
       getAll: () => store.getAll(),
       setAll: (list) => list.forEach(({ name, value, options }) => store.set(name, value, options)),
     },
   });

4. In the Supabase dashboard, Authentication, URL Configuration: set the Site URL to your production domain and add your reset page (for example https://yourapp.com/reset-password) to the redirect URLs.
5. Where a signed-out visitor is a normal case, read the session first and branch on it instead of calling getUser blindly.

   const { data: { session } } = await supabase.auth.getSession();
   if (!session) return showSignIn();

How to check it is fixed

Request a reset email for a test account, open the link in a private window on the production domain, set a new password: no error, and signing in with the new password works. A signed-out visitor sees the sign-in screen, not an error.