Fix guides / Supabase: "Invalid Refresh Token: Refresh Token Not Found"

How to fix Supabase "Invalid Refresh Token: Refresh Token Not Found"

The console shows AuthApiError: Invalid Refresh Token: Refresh Token Not Found (or Already Used), and users are bounced to the login page. Supabase is trying to renew a session with a refresh token it no longer recognises.

What a refresh token is doing here

A Supabase session has a short-lived access token and a refresh token. When the access token expires, the client trades the refresh token for a new pair. Each refresh token can be used once. If the stored one was already used, revoked, or belongs to another project, you get this error.

Cause 1: an old session from a different project or after a reset

If you changed Supabase projects, reset the database, or rotated keys, the browser still holds a token for the old setup. Clear it and sign in again. In code, sign out cleanly when the error appears:

supabase.auth.onAuthStateChange((event, session) => {
  if (event === 'TOKEN_REFRESHED' && !session) supabase.auth.signOut();
});

const { error } = await supabase.auth.getSession();
if (error?.message?.includes('Refresh Token')) {
  await supabase.auth.signOut({ scope: 'local' });
}

Cause 2: more than one Supabase client

AI builders often call createClient in several files. Each client tries to refresh the same token, one wins, and the others then hold a used token. Create the client once and import it everywhere:

// src/lib/supabase.ts
import { createClient } from '@supabase/supabase-js';
export const supabase = createClient(
  import.meta.env.VITE_SUPABASE_URL,
  import.meta.env.VITE_SUPABASE_ANON_KEY
);

Search for duplicates with grep -rn "createClient(" src.

Cause 3: Next.js server code cannot save the new token

With @supabase/ssr, the token is refreshed in middleware and written back as cookies. If middleware is missing or does not copy cookies onto the response, the server keeps sending the old token. Follow the official middleware pattern: create a server client in middleware.ts, call supabase.auth.getUser(), and return the response object whose cookies the client set. Do not create a fresh NextResponse after the client has written cookies.

Cause 4: two tabs or devices racing

Recent versions of supabase-js handle tab coordination, so upgrade first: npm i @supabase/supabase-js@latest. Supabase also allows a short reuse interval for refresh tokens under Authentication, Sessions which absorbs most races.

Check the fix

1. Log in, leave the tab open past the access token lifetime (one hour by default), then click around.
2. No refresh errors in the console and no surprise logouts.

Last updated 2026-10-19.