PricingBlog

Supabase refresh access token

  • jose_49429-1531702789762187416

    Jose

    1 day ago

    What is the recommended pattern for public pages that display different data depending on whether a Supabase session exists? Specifically, how should optional authenticated API calls wait until supa-refresh-session-handler has completed?
  • tomthebigtree-1531896520159395952

    Tom Ireland

    18 hours ago

    Hey Jose. Would this not be down to RLS (Row Level Security)? You can enable Supabase RLS for different roles, so you could have some data be available for a non-authenticated user vs an authenticated user. See https://supabase.com/docs/guides/database/postgres/row-level-security
  • tomthebigtree-1531897566629728326

    Tom Ireland

    18 hours ago

    I'm a bit rusty on auth with Supabase, but assuming you're making an API call on your pages to get certain table data, it will return data based on those RLS policies.

    If you're not authenticated but RLS policies allow read of table data for anon, this data would be fetched. If authenticated, you should then get additional data based on your authenticated user.

    Video examples of your issue would be helpful for context so the community can help you as best they can.
  • jose_49429-1532016165180932246

    Jose

    10 hours ago

    We are using the Supabase Connect package.

    supa-refresh-session-handler refreshes expired access tokens correctly.

    However, on public pages we have APIs that use Authorization: Bearer {{cookies.access_token}}.

    Those APIs frequently execute before the refresh completes, so they run anonymously and return different data.

    What is the recommended way to delay authenticated API requests until the refresh handler has finished?

    Is there an event, promise, context value, or recommended pattern for waiting on session initialization?
  • tomthebigtree-1532105204118327427

    Tom Ireland

    4 hours ago

    Are you doing your API call on load, Jose? I would maybe use the component on success event to re-trigger your API call maybe. At least you know the token has refreshed at that point.