PatchVault › Errors › Supabase auth-helpers → @supabase/ssr

[AuthApiError]: Invalid Refresh Token: Session Expired

The session behind the refresh token has ended, either by the project's session time-box or inactivity timeout or by a sign-out, so Auth refuses to issue new tokens.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/supabase-ssr-scan.py) .

Why it happens

Code that keeps retrying with the stale cookie makes this repeat on every request. Old cookie handlers (get/set/remove) can also leave stale chunked cookies behind. See supabase/ssr issue #91.

Manual fix

const { data: { user }, error } = await supabase.auth.getUser()
if (error?.code === 'session_expired' || !user) {
  await supabase.auth.signOut({ scope: 'local' })   // clears the stale cookies
  return NextResponse.redirect(new URL('/login', request.url))
}

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• supabase/ssr issue #91
• Supabase: user sessions

Related errors

• @supabase/auth-helpers-nextjs is deprecated: fix
• @supabase/ssr get/set/remove cookies deprecated
• Supabase "Invalid Refresh Token: Refresh Token Not Found"
• Cookies can only be modified in a Server Action (Supabase)
• Supabase getSession() "could be insecure" warning

Full guide and free terminal scanner: Supabase auth-helpers → @supabase/ssr. Last checked 2026-10-31.