name: supabase-edge-runtime-401-debug

description: Debug 401 errors on Supabase Edge Runtime when all requests (authenticated or not) return 401 through Kong → functions-proxy → edge-runtime chain

triggers:

- "edge function returns 401 for all requests"

- "functions-proxy 401 even without Authorization header"

- "edge-runtime unresponsive through Kong proxy"

- "manage-users 401 Kong VPS"

Supabase Edge Runtime 401 Debugging Workflow

Problem Pattern

All requests to /functions/v1/ through Kong return 401, including:

• - Requests WITHOUT any Authorization header → should NOT return 401 from JWT logic
• - Requests WITH valid VPS tokens → returns 401

This means the 401 is NOT coming from the edge function's JWT verification (which would only reject if token is present AND invalid). The rejection happens earlier in the chain.

Diagnostic Steps

Step 1: Test from INSIDE Kong container (no external auth)

`bash

Get Kong container name

docker ps --format '{{.Names}}' | grep kong

From inside Kong, test the upstream directly

docker exec -it wget -O- -q 'http://127.0.0.1:8000/functions/v1/'

Also test WITHOUT going through Kong's route

docker exec -it wget -O- -q 'http://deploy-vps-functions-proxy:9000/anything'

`

Step 2: Test direct from host to functions-proxy

`bash

Get functions-proxy container

docker ps --format '{{.Names}}' | grep functions-proxy

Test proxy directly (no Kong)

docker exec -it wget -O- -q 'http://localhost:9000/anything'

`

Step 3: Test edge-runtime directly

`bash

Get edge-runtime container

docker ps --format '{{.Names}}' | grep 'functions-1'

Test directly to edge-runtime (port 9001)

docker exec -it wget -O- -q 'http://localhost:9001/'

Check if edge-runtime is listening

docker exec -it netstat -tlnp 2>/dev/null || ss -tlnp

`

Step 4: Check edge-runtime logs

`bash

Get edge-runtime container ID

docker ps -a --format '{{.ID}} {{.Names}}' | grep functions

Get recent logs

docker logs --since 30s

If logs only show "shutdown signal received" - the process is stuck/broken

`

VPS Supabase Edge Function 401 — New Findings (Jun 2026)

Two Code Paths Exist on VPS

• - /opt/rochasales/supabase/functions/ → mounted to container at /home/deno/functions/ (container USES this)
• - /opt/rochasales/volumes/functions/ → backup/alternative, NOT used by container
• - Both containers (auth and functions) mount from /opt/rochasales/supabase/
• - Critical: When modifying Edge Function code, always edit /opt/rochasales/supabase/functions//index.ts

Container Recreated = Code Reset

• - Functions container was recreated on Jun 3 19:49 UTC — AFTER requests that worked previously
• - If container was recreated, original code is restored — any custom fixes must be re-applied
• - Check container creation time: docker inspect --format '{{.Created}}'

Debug Code Not Taking Effect

• - Modified Edge Function code with debug output was written to container (verified via docker exec cat)
• - But response remained old format after multiple container restarts
• - Possible causes: Deno runtime caching, hot-reload not working, or another layer intercepting
• - Always restart container after code changes: docker restart deploy-vps-functions-1

JWT_SECRET Byte-Exact Verification

• - Compare secrets using hex dump to rule out encoding issues:

docker exec sh -c 'echo -n "SECRET" | od -An -tx1 | tr -d " "

• - Both auth and functions containers should show identical hex output

Kong DB-less Mode

• - KONG_DATABASE=off means Kong uses YAML config, no dynamic plugin loading
• - Config file: /tmp/kong.yml on host (verified as DB-less)
• - JWT verification plugins are NOT automatically applied in DB-less mode
• - If 401 persists even with service key, the issue is in the Edge Function itself or in headers being stripped

Admin Panel Works Because It Uses REST API Directly

• - The browser admin uses /rest/v1/users directly (Supabase REST API), NOT the Edge Function
• - The Edge Function /functions/v1/manage-users is a separate endpoint that requires different auth
• - This explains why admin works in browser but direct API calls return 401

Previous Findings

JWT_SECRET Mismatch Pattern

The root cause of 401 in Supabase Edge Runtime is almost always JWT_SECRET mismatch between auth and functions containers.

Check via Python (most reliable):

Resolution Options

Option A: Restart edge-runtime (if acceptable)

`bash

docker restart

Wait 5s, then test again

docker exec -it wget -O- -q 'http://127.0.0.1:8000/functions/v1/'

`

Risk: Brief downtime for all edge functions on that runtime. Affects ALL functions on that instance.

Option B: Restart functions-proxy

`bash

docker restart

`

Option C: Full docker-compose restart (if no other option works)

`bash

cd /opt/rochasales

docker compose restart functions functions-proxy

`

Option D: Migrate to Supabase Cloud (if VPS debugging fails)

If the edge-runtime can't be fixed without restart, migrate the edge function to Supabase Cloud:

`bash

cd /opt/rochasales

supabase functions deploy --project-ref

`

Then update the frontend to call the cloud URL instead of VPS URL for that function only.

Critical Context for Rocha Sales VPS (Jun 2026)

• - JWT_SECRET (VPS): kETxz0JNJhJyg5UYxbd8zG6g2v9kXTYZGjY+3v7LUKI= (byte-exact verified match)
• - Kong Admin API: http://127.0.0.1:8001 (from inside Kong container)
• - functions-proxy container: deploy-vps-functions-proxy-1
• - edge-runtime container: deploy-vps-functions-1
• - edge-runtime command: edge-runtime start --main-service /home/deno/functions/main
• - Container created: 2026-06-03T19:49:24.831520044Z (AFTER the requests that worked on June 3)
• - Docker network: deploy-vps_default
• - Code path used by container: /opt/rochasales/supabase/functions/ (NOT /opt/rochasales/volumes/functions/)

Known Symptoms (Jun 2026 — unresolved)

• - /functions/v1/main returns 200 ✓
• - /functions/v1/manage-users returns {"error":"Unauthorized"} ✗
• - Token signature verified valid via Python HMAC-SHA256
• - JWT_SECRET byte-exact match confirmed between containers
• - Kong DB-less, no JWT plugins on functions routes
• - Root cause NOT yet identified

Verification After Fix

`bash

Test from Kong

docker exec -it wget -O- -q 'http://127.0.0.1:8000/functions/v1/'

Test from outside (with token)

curl -s 'https://rochasalesseguros.com.br/functions/v1/' \

-H 'Authorization: Bearer ' \

-H 'apikey: '

`

Common Pitfalls

1. "No restart" constraint can be counterproductive. If edge-runtime is in a broken state, a simple docker restart often fixes it.

2. Container recreation resets code. If the functions container was recreated (check docker inspect --format '{{.Created}}'), any custom code in the volume is overwritten with the original. Re-apply fixes after container recreation.

3. Two code paths — edit the right one. The container mounts from /opt/rochasales/supabase/functions/, NOT /opt/rochasales/volumes/functions/. Always verify which path the container is actually reading from.

4. Admin panel working ≠ Edge Function working. The admin UI may work via Supabase REST API (/rest/v1/) while the Edge Function (/functions/v1/) still returns 401. These are separate auth paths.

5. Debug code not taking effect. If you modified the Edge Function and the response doesn't change, the runtime may be caching. Verify the code is actually in the container with docker exec cat /home/deno/functions//index.ts and restart the container.

Only pursue complex debugging (Option C without restart) if:

1. You have confirmed OTHER services on the VPS cannot tolerate the restart

2. You have exhausted the diagnostic steps above

3. You have verified the 401 is NOT coming from Kong's JWT plugin (no JWT plugins found in Kong config)