"Invalid API key" from Supabase: your live app ships a key that no longer works
Every sign-in and data request from your users fails with 401 "Invalid API key". The key built into your live app was rotated, disabled or replaced, but the deployed app still sends the old one.
What is happening
Your app's public (anon or publishable) key is compiled into the code your site serves. If the key changes in Supabase and the app is not redeployed with the new one, every request is refused with the gateway code UNAUTHORIZED_INVALID_API_KEY.
Supabase is moving projects from legacy JWT keys to new publishable and secret keys, so a key change you did not make yourself can still happen during a migration.
How to fix it
Copy the current public key from the project's API settings in Supabase into your app's environment settings.
Redeploy or republish the app so the new key is built in, then sign in once on the live site to confirm.
Never put a service_role or sb_secret_ key in the front end, even temporarily: anyone can read it.
Check your app now — free, no sign-up
Paste your app's address and see, from the outside, whether it loads, whether its database is awake, and whether anything here applies to you.
Run the free checkSources
Checked against these sources on 26 October 2026.