PatchVault › Errors › Supabase auth-helpers → @supabase/ssr

Error: Route "/dashboard" used `cookies().getAll()`. `cookies()` should be awaited before using its value. Learn more: https://nextjs.org/docs/messages/sync-dynamic-apis

After upgrading to Next.js 15 the dev server logs this for every request that builds a Supabase server client, because the client reads cookies() synchronously.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .
Get the Supabase auth-helpers → @supabase/ssr auto-fixer: $9 one-time

Why it happens

In Next.js 15, cookies() is an async function that returns a promise. Synchronous access still works in 15 for backwards compatibility but is deprecated, so Next.js logs the sync-dynamic-apis error.

Manual fix

// utils/supabase/server.ts
export async function createClient() {
  const cookieStore = await cookies()
  return createServerClient(URL, KEY, {
    cookies: { getAll: () => cookieStore.getAll(), setAll: (c) => { /* ... */ } },
  })
}
// callers: const supabase = await createClient()

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

Related errors

Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.