Invalid API key (Supabase)

What it means in plain English

Every request your app makes to Supabase carries an API key. "Invalid API key" means Supabase got a key it doesn't recognise for that project, or got no key at all.

Likely causes

• The env vars holding your Supabase URL and key were never added to your host (Vercel/Netlify), so the app sends undefined.
• You copied the key from a different Supabase project than the URL.
• Extra spaces, quotes or a cut-off key when pasting.
• You disabled the legacy anon/service_role keys in Supabase but the app still uses them. (Supabase is deprecating those legacy keys by end of 2026 in favour of sb_publishable_… and sb_secret_… keys.)
• A secret key is being used in the browser: Supabase blocks secret keys from browsers and returns 401.

How to fix it, step by step

1. In Supabase open Settings → API Keys (or the Connect button) and copy the Project URL and the publishable key (sb_publishable_…, or the legacy anon key starting eyJ if your app was built with it).
2. Check both come from the same project (the project ref in the URL matches the dashboard).
3. Put them in your host's environment variables using the exact names your code reads:
   • Vite apps (Lovable, Bolt): VITE_SUPABASE_URL, VITE_SUPABASE_PUBLISHABLE_KEY (or whatever name appears in src/integrations/supabase/client.ts / your client file).
   • Next.js (v0, Cursor): NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY.
4. Paste values with no quotes or spaces.
5. Redeploy. Vercel applies env var changes only to new deployments.
6. If you rotated or disabled legacy keys, update every place that used the old one.
7. Never use the sb_secret_/service_role key in front-end code; keep it for server code only.

How to check it worked

• Open the live site, open the browser DevTools Network tab and reload; Supabase requests should return 200, not 401.
• Sign in or load a page that reads data; the error should be gone.

Sources

• https://supabase.com/docs/guides/api/api-keys (opens in a new tab)
• https://vercel.com/docs/environment-variables (opens in a new tab)
• https://vite.dev/guide/env-and-mode (opens in a new tab)
• https://nextjs.org/docs/app/guides/environment-variables (opens in a new tab)