An Edge Function turns auth off and never checks the caller

Symptom

A function that changes data or spends money returns 200 with no session. It was set to verify_jwt = false, or auth: 'none', to clear a 401 during development.

Root cause

Supabase's Edge Function auth guide says the default is verify_jwt = true, so the platform checks the user JWT before the handler runs. Turning that off to get past a 401 removes the platform check. auth: 'none' accepts every caller. The guide says that mode is for a public health check, or for a webhook that verifies the provider's own signature inside the handler. If the function reads or writes sensitive data, the handler has to authenticate the caller itself. Lovable's best practices say a function running on the server is still callable by a client, so server-side execution alone is not privacy.

In this project only, open supabase/config.toml and every Edge Function.

1. For functions called by a signed-in user, keep verify_jwt = true and use auth: 'user'. Read data with the RLS-scoped client.
2. For a webhook, keep verify_jwt = false and auth: 'none', and verify the provider signature before any write. Reject missing signatures with 400.
3. Delete auth: 'none' from any function that updates users, deletes rows, or calls a paid API, unless it verifies a signature.
4. Do not deploy a function that mutates data with no caller check.

Only edit this project's functions.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own repo, search for verify_jwt = false and auth: 'none'.
2. For each match, read the handler. It should verify a webhook signature or do nothing sensitive.
3. While signed out of your own app, trigger the function the way your UI does, without a session. A mutating function should reject you.

Sources

• Supabase: Securing Edge Functions
• Lovable: Security best practices