Hey @codebyfredrik 💚
In order to verify the new token types you need to follow this guide.
Previous legacy tokens was issued using symmetric JWT secret, now it uses asymmetric pair, here's a template for verifying it.

You need update your jwtVerify() to use JWKs instead of JWT_SECRET

Um, yeah, the new token isn't a symmetric JWT - it's a new asymmetric one:

% echo eyJhbGciOiJFUzI1NiIsImtp | base64 -d
{"alg":"ES256","ki%

But again, it might be because of the issue with the updated CLI and how it (both updated and) generated new docker configs.

Do you think you could try it on a clean repo clone with an older version of CLI that worked for you before?

I can definitely give it a try. I'm also wondering if starting supabase with pnpm dlx supabase start could be an issue? No specific version meaning I will always get the latest version available when I start supabase?

When I check docker images I see this:

REPOSITORY TAG IMAGE ID CREATED SIZE
public.ecr.aws/supabase/postgres-meta v0.95.2 fd819ee65489 5 days ago 525MB
public.ecr.aws/supabase/storage-api v1.33.5 b7486fec6ccf 5 days ago 986MB
public.ecr.aws/supabase/studio 2026.01.07-sha-037e5f9 ab7f0f0bb923 7 days ago 1.48GB
public.ecr.aws/supabase/edge-runtime v1.70.0 d5b0545da782 9 days ago 1.07GB
public.ecr.aws/supabase/realtime v2.69.2 7305790ea396 9 days ago 660MB
public.ecr.aws/supabase/postgrest v14.3 7c5840727ad6 11 days ago 587MB
public.ecr.aws/supabase/storage-api v1.33.4 cfea6cdfaf7e 2 weeks ago 986MB
public.ecr.aws/supabase/realtime v2.69.1 f38207af46fc 2 weeks ago 660MB
public.ecr.aws/supabase/studio 2025.12.29-sha-c223130 53fd9051c80c 2 weeks ago 1.42GB
public.ecr.aws/supabase/storage-api v1.33.2 a42f28814fa5 3 weeks ago 986MB
public.ecr.aws/supabase/postgrest v14.2 b2ea09cbdb66 3 weeks ago 587MB

So maybe new images are not the problem, but the version of the CLI.

Would it be a good idea to remove current docker image and start supabase with a specific version (not containing asymmetric keys as default)?

Would it be a good idea to remove current docker image and start supabase with a specific version (not containing asymmetric keys as default)?

If you'd like to keep your application as-is for now (using symmetric JWT, etc.) - then I'd suggest this downgrade experiment, yes.

Great!

Eventually will go for asymmetric keys since that is better in many ways. But right now I just want to get things working again.

Hey @codebyfredrik 💚
The legacy keys will be deprecated and then removed in the future — Ref to timetable

So the recommendation is to already start to migrate and use the new approach.

But if you really need to force a specific docker version, you can do it by creating a file at supabase/.temp/<service-version> then write the chosen image version there:

echo 'v2.183.0' > supabase/.temp/gotrue-version