PatchVault › Errors › Supabase auth-helpers → @supabase/ssr
AuthApiError: Invalid Refresh Token: Refresh Token Not Found
Supabase Auth rejected a refresh because the refresh token in the cookie was already used, revoked or never written back. The user usually appears logged out at random.
Check your code free (runs in your browser)
The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.
Or scan your whole repo locally (free, stdlib Python, read-only):
python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .Why it happens
Common causes: several server clients refreshing the same session concurrently, middleware that refreshes but returns a response without the new cookies, or leftover auth-helpers clients next to @supabase/ssr. It is reported in supabase/ssr issue #68.
Manual fix
// middleware.ts: exactly one refresh per request, and return the response that setAll wrote to
let response = NextResponse.next({ request })
const supabase = createServerClient(URL, KEY, { cookies: { getAll, setAll } })
await supabase.auth.getUser() // refreshes + writes cookies via setAll
return response // not a fresh NextResponse.next()Verify
Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.
Sources
Related errors
- @supabase/auth-helpers-nextjs is deprecated: fix
- @supabase/ssr get/set/remove cookies deprecated
- Supabase "Invalid Refresh Token: Session Expired"
- Cookies can only be modified in a Server Action (Supabase)
- Supabase getSession() "could be insecure" warning
Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.