@supabase/supabase-js 2.110.6-canary.0 → 2.110.6-canary.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/supabase-js",
-  "version": "2.110.6-canary.0",
+  "version": "2.110.6-canary.2",
   "description": "Isomorphic Javascript SDK for Supabase",
   "keywords": [
     "javascript",
@@ -59,11 +59,11 @@
     "directory": "packages/core/supabase-js"
   },
   "dependencies": {
-    "@supabase/functions-js": "2.110.6-canary.0",
-    "@supabase/auth-js": "2.110.6-canary.0",
-    "@supabase/realtime-js": "2.110.6-canary.0",
-    "@supabase/storage-js": "2.110.6-canary.0",
-    "@supabase/postgrest-js": "2.110.6-canary.0"
+    "@supabase/auth-js": "2.110.6-canary.2",
+    "@supabase/functions-js": "2.110.6-canary.2",
+    "@supabase/postgrest-js": "2.110.6-canary.2",
+    "@supabase/realtime-js": "2.110.6-canary.2",
+    "@supabase/storage-js": "2.110.6-canary.2"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.2",

package/src/SupabaseClient.ts

@@ -20,7 +20,7 @@ import {
   DEFAULT_REALTIME_OPTIONS,
   DEFAULT_TRACE_PROPAGATION_OPTIONS,
 } from './lib/constants'
-import { assertSupportedApiKey, fetchWithAuth } from './lib/fetch'
+import { checkApiKeyFormat, fetchWithAuth } from './lib/fetch'
 import {
   applySettingDefaults,
   validateSupabaseUrl,
@@ -315,7 +315,7 @@ export default class SupabaseClient<
   ) {
     const baseUrl = validateSupabaseUrl(supabaseUrl)
     if (!supabaseKey) throw new Error('supabaseKey is required.')
-    assertSupportedApiKey(supabaseKey)
+    checkApiKeyFormat(supabaseKey)
 
     this.realtimeUrl = new URL('realtime/v1', baseUrl)
     this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace('http', 'ws')

package/src/lib/fetch.ts

@@ -24,27 +24,35 @@ export const resolveHeadersConstructor = () => {
 /**
  * New-format Supabase API keys (`sb_publishable_…` / `sb_secret_…`) are not JWTs and
  * must never be sent as a Bearer token — they belong only in the `apikey` header.
- * Legacy (JWT) keys predate this format (they don't start with `sb_`) and keep their
- * existing behavior. Any other `sb_`-prefixed key is an unrecognized future subtype;
- * see {@link assertSupportedApiKey}.
+ * All other keys (legacy JWT keys, `sb_temp_…` temporary keys, unrecognized `sb_`
+ * subtypes) keep the Bearer fallback.
  */
 const isNewApiKey = (key: string): boolean =>
   key.startsWith('sb_publishable_') || key.startsWith('sb_secret_')
 
+const TEMP_KEY_PREFIX = 'sb_temp_'
+
+const warnedKeySubtypes = new Set<string>()
+
 /**
- * Fail fast on an `sb_`-family key whose subtype this SDK version does not recognize, so a
- * future key type can never be silently mistreated as a legacy JWT and sent as a Bearer
- * token. Recognized new-format keys and legacy JWT keys (no `sb_` prefix) pass through.
- * The key itself is never included in the message to avoid leaking secret keys.
+ * Warn (once per subtype) when an `sb_` key isn't a subtype this SDK version recognizes.
+ * Never throws — the server, not the SDK, decides key validity. The key value is never
+ * included in the message.
  */
-export const assertSupportedApiKey = (key: string): void => {
-  if (key.startsWith('sb_') && !isNewApiKey(key)) {
-    throw new Error(
-      '@supabase/supabase-js: Unrecognized Supabase API key format. Expected a legacy JWT key ' +
-        'or a new-format key (sb_publishable_… / sb_secret_…). This "sb_" key type is not ' +
-        'supported by this version of the SDK — please upgrade @supabase/supabase-js.'
-    )
+export const checkApiKeyFormat = (key: string): void => {
+  if (!key.startsWith('sb_') || isNewApiKey(key) || key.startsWith(TEMP_KEY_PREFIX)) {
+    return
+  }
+  const subtype = key.match(/^sb_[a-zA-Z0-9]+_/)?.[0] ?? 'unknown'
+  if (warnedKeySubtypes.has(subtype)) {
+    return
   }
+  warnedKeySubtypes.add(subtype)
+  console.warn(
+    '@supabase/supabase-js: Unrecognized Supabase API key format. The client will proceed ' +
+      'and send this key as-is; if you see authentication errors you may need to upgrade ' +
+      '@supabase/supabase-js to a version that recognizes this key type.'
+  )
 }
 
 export const fetchWithAuth = (

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.110.6-canary.0'
+export const version = '2.110.6-canary.2'