Explain the lifecycle of a Supabase Auth session token?

When a user signs in, Supabase Auth issues two tokens: a short-lived access token (a JWT, typically valid for about an hour) that's sent with every API request to prove identity, and a longer-lived refresh token that's used only to obtain a new access token once the current one expires.

The access token's claims (including the user's ID as sub, which becomes auth.uid() inside RLS policies) are self-contained and verifiable without a database round trip, which is why PostgREST can check them cheaply on every request. When the access token nears expiry, the client SDK automatically calls the token refresh endpoint with the refresh token, and if that refresh token is still valid and hasn't been revoked, Auth issues a new access/refresh token pair — refresh tokens are typically single-use and rotated on each refresh, so a stolen but already-used refresh token becomes worthless.

Sign-out invalidates the current session's refresh token server-side, which prevents further refreshes, though any access token issued before sign-out remains technically valid (and usable) until its own short expiry passes, since it's a self-contained JWT rather than something checked against a live session table on every request.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.