Try or ByeTry or Bye

Supabase 'Invalid Refresh Token: Refresh Token Not Found'

Workaround available Web (Next.js, SSR frameworks) Updated October 21, 2026

Quick answer

Refresh tokens are single-use; if middleware refreshes the session but doesn't write the new cookie back, the next request uses a dead token. Return the response object your cookie setAll modified.

Most likely fix: Return the same response from middleware.

Symptoms

Users are logged out randomly (often daily), server logs show AuthApiError 'Invalid Refresh Token: Refresh Token Not Found' or 'AuthSessionMissingError: Auth session missing!'.

Why it happens

  • Next.js middleware refreshes the session but returns a different response without the new cookies
  • Route handler creates its own client without reading request cookies
  • Session revoked or expired after long inactivity
  • Local storage/cookies cleared

How to fix it

Try these in order — the most common fix is first.

  1. 1. Return the same response from middleware

    1. Use createServerClient from @supabase/ssr in middleware
    2. In cookies.setAll write cookies to the response object
    3. Return exactly that response object

  2. 2. Use a cookie-aware client in route handlers

    1. Create createServerClient with await cookies() inside the handler
    2. Make sure the middleware matcher covers the route

  3. 3. Use getUser() on the server

    1. Call supabase.auth.getUser() rather than trusting getSession() server-side

  4. 4. Sign the user out cleanly on this error

    1. Catch the error, call supabase.auth.signOut() and redirect to login

This guide also covers

  • invalid refresh token refresh token not found supabase
  • supabase auth session missing
  • supabase user logged out randomly
  • supabase nextjs session not persisting

Still not working?

If Supabase keeps failing, you're not alone. See every Supabase problem users report or the alternatives people switch to.

Other Supabase errors