parity(functions): never send new-format API key as Authorization Bearer [from supabase-js]

[grdsdev]

SDK Parity: C# implementation needed

A change was made in supabase-js that needs to be implemented in this repository for SDK parity.

Reference Implementation (supabase-js)

• Commit: 558c1f5
• PR: #2511
• Module: functions / client
• Type: bug-fix (security-relevant)

What Changed

New-format API keys (sb_publishable_… / sb_secret_…) must never be sent as a Bearer token. Edge Functions calls now use a dedicated fetch path where apikey always carries the key and Authorization only carries a real session JWT — with no session and a new-format key, no Bearer key fallback is sent. Legacy JWT keys are unaffected.

Code Reference

this.functionsFetch = fetchWithAuth(
  supabaseKey, supabaseUrl, this._getSessionToken.bind(this),
  settings.global.fetch, settings.tracePropagation,
  { omitApiKeyAsBearer: true }
)

Confirmed in supabase-csharp: Supabase/Client.cs:256-275 GetAuthHeaders() sets bearer = Auth.CurrentSession?.AccessToken ?? _supabaseKey and Authorization: Bearer {bearer} when there's no session — meaning the raw Supabase key (including new-format sb_publishable_/sb_secret_) is sent as the Bearer token whenever no session exists. This is the exact bug supabase-js fixed, and it applies to Functions invoke() as well since it shares this header path.

Implementation Guidance

Expected API Surface

Functions invoke path needs its own header-resolution logic distinct from REST/Storage: apikey always carries the key; Authorization only carries a session JWT, never a new-format key. Legacy JWT keys keep existing Bearer fallback.

Acceptance Criteria

• Fix implemented matching supabase-js behavior
• Unit tests cover: no-session+new-key, no-session+legacy-key, has-session
• No breaking changes to existing legacy-key behavior

Context

• supabase-js version: v3.0.0-next.29 / 2.110.6
• Parity tracking: This issue was auto-generated by SDK parity analysis
• Related parity issues: supabase-flutter (SDK-1320), supabase-py (SDK-1325), supabase-swift (SDK-1329), supabase-kt (#1357)

---

Generated with Claude Code /sync-sdk-parity

[grdsdev]

Related parity issues:

• supabase-flutter: https://linear.app/supabase/issue/SDK-1320
• supabase-py: https://linear.app/supabase/issue/SDK-1325
• supabase-swift: https://linear.app/supabase/issue/SDK-1329
• supabase-kt: parity(functions): never send new-format API key as Authorization Bearer [from supabase-js] supabase-community/supabase-kt#1357

[fresh55]

Looks fixed by 66a5fd3 (#397), shipped in 8.0.0

@Tr00d closable? Could use the area: functions label too.