PatchVault › Errors › Supabase auth-helpers → @supabase/ssr

Error: Cookies can only be modified in a Server Action or Route Handler

Next.js threw because the Supabase server client tried to write auth cookies while a Server Component was rendering, and Server Components cannot set cookies.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .
Get the Supabase auth-helpers → @supabase/ssr auto-fixer: $9 one-time

Why it happens

The client refreshed the session during render and called set/setAll. It is reported in supabase/supabase #28489. The fix is to refresh in middleware and make the Server Component client tolerate the write failure.

Manual fix

// utils/supabase/server.ts
const cookieStore = await cookies()
return createServerClient(URL, KEY, {
  cookies: {
    getAll() { return cookieStore.getAll() },
    setAll(cookiesToSet) {
      try { cookiesToSet.forEach(({ name, value, options }) => cookieStore.set(name, value, options)) }
      catch { /* called from a Server Component: middleware refreshes the session */ }
    },
  },
})

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

Related errors

Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.