fix guide
Supabase AuthSessionMissingError: Auth session missing
Harjot ·
Your Supabase app shows "AuthSessionMissingError: Auth session missing!" in the console or on screen. It often appears right after login, after a refresh, or on the password reset page.
The message means the app asked Supabase who is logged in and found nobody. Either the visitor really is signed out, the app asked before the saved login finished loading, or the login never got saved. Check these four in order.
1. Check whether anyone is signed in
Supabase's getUser call checks the login with the Auth server, and it uses the saved login from the current session. If the visitor never signed in, or signed out, there is nothing to check and you get this error.
Open the page in a private window and watch the console before you sign in. If the error shows up there and goes away after you sign in, your app calls getUser on a page that logged-out visitors can reach, such as the home page or a layout that loads on every page.
Treat this error as "signed out". Show the login page, or skip the call until a login exists, instead of showing the error.
signs The error shows on first load in a private window and goes away once you sign in.
2. Wait for the saved login to load
The app reads the saved login from the browser when it starts. If your code calls getUser before that finishes, it finds nobody, even though the visitor is signed in.
Supabase's docs say to register the onAuthStateChange listener immediately after calling createClient. Do that once, in the file that creates the client. Make the page show a loading state until the listener has reported, and only then decide the visitor is signed out.
The docs also note the listener is safe to use without an async function as the callback, so keep the callback a plain function.
signs A signed-in visitor is sent to the login page for a moment on load or refresh, then everything works.
3. The password reset page
On a reset page this error usually means the page opened with no login. The login comes from the link in the reset email.
Supabase's docs say resetPasswordForEmail takes a redirectTo that should point to your change password page, and that URL has to be in your Redirect URLs list. Open Authentication, then URL Configuration, and check it is there.
That page calls updateUser, which the docs describe as updating data for a logged in user. If someone types the page's address into the browser instead of using the email link, there is no login and you get this error. The docs' React example waits for the PASSWORD_RECOVERY event from onAuthStateChange before showing the new password form. Do the same.
If your app uses the PKCE flow, the docs say the email links to an /auth/confirm route in your app. That route calls verifyOtp with the token hash, then redirects to the password page. A missing or broken /auth/confirm route means no login.
signs The error shows only on the password reset page, or only when the page is opened without the email link.
4. Next.js server code
Next.js apps that read the login on the server need a proxy file to refresh it. Supabase's docs say Next.js 16 renamed middleware.ts to proxy.ts, and that on Next.js 15 and earlier a proxy.ts file is never called, so sessions never refresh and users get signed out. Check your Next.js version in package.json and name the file to match.
In server code, the docs say to use getUser, and never to trust getSession, because it reads the cookie without checking it with the Auth server.
signs The error shows on server-rendered pages, or logged-in users get signed out after a while.
Test it like a new user
- Open a private window and visit the page that shows the error before signing in. It should show your login page, not the error.
- Sign in, then refresh the page three times. You stay signed in.
- Request a password reset and open the email link in the same browser. The new password form loads.
- Open the reset page's address directly in a fresh private window. It sends you to login or asks for a new link instead of showing the error.
Common questions
What does AuthSessionMissingError: Auth session missing! mean?
The app asked Supabase who is logged in and had no saved login to check. Either the visitor is signed out, the app asked before the saved login finished loading, or the login never got saved, for example on a password reset page opened without its email link.
Why do I get Auth session missing on the password reset page?
The page needs the login that comes from the reset email link. Opened without that link, there is no login. Check that the redirectTo in your reset request points to your change password page and is listed under Redirect URLs in Authentication, then URL Configuration.
Should I use getSession or getUser to avoid this error?
Use getUser when you need to trust who is signed in, because it checks with the Supabase Auth server. It reports this error when nobody is signed in, so treat that case as signed out and show the login page. In server code, Supabase says never to trust getSession.
Still stuck?
Not sure this is the cause? Paste your app's link into the free scan. It lists what a visitor's browser can see, like leaked keys and exposed files, worst first. The score is free; every fix as a prompt for your builder is $9, one-time.
Want a person to look inside? See the diagnosis