Files
supabase/apps/docs/content/guides/functions/schedule-functions.mdx
Blut-agentandKalleby Santos 15214d02de fix(docs): use proper apikey instead of Authorization header for Functions examples (#46013)
## Problem

The Supabase Functions documentation shows examples that send a
publishable key in the `Authorization: Bearer` header. This causes
`UNAUTHORIZED_INVALID_JWT_FORMAT` errors because publishable keys are
not JWTs.

Per the [Understanding authorization
headers](/docs/guides/functions/auth#understanding-authorization-headers)
guide:
> A common mistake is sending a publishable or secret key as a bearer
token: `Authorization: Bearer sb_pub.....`. The new API keys are not
JWTs. The platform check can't validate them, and your handler can't
verify them as JWTs either. Instead, put API keys in the `apikey`
header.

## Fix

Updated three documentation files to use the `apikey` header instead of
`Authorization: Bearer` when calling Edge Functions with a publishable
key:

- **quickstart-dashboard.mdx**: Changed fetch example from
`Authorization: 'Bearer YOUR_PUBLISHABLE_KEY'` to `apikey:
'<SUPABASE_PUBLISHABLE_KEY>'`
- **recursive-functions.mdx**: Changed fetch example from
`Authorization: \`Bearer ${SUPABASE_DEFAULT_PUBLISHABLE_KEY}\`` to
`apikey: SUPABASE_DEFAULT_PUBLISHABLE_KEY`
- **schedule-functions.mdx**: Changed SQL cron example from
`'Authorization', 'Bearer ' || ...` to `'apikey', ...`

## Related

-
[supabase/supabase#45993](https://github.com/supabase/supabase/issues/45993)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated Function guide examples for invoking Edge Functions to send
the publishable key in an `apikey` request header instead of using an
`Authorization: Bearer ...` header.
* Aligned both `fetch` and scheduled-invocation examples with the
updated authentication snippet.
* Refreshed an example output comment to match the updated response
text.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
2026-06-15 12:41:19 +00:00

62 lines
1.9 KiB
Plaintext

---
id: 'schedule-functions'
title: 'Scheduling Edge Functions'
description: 'Schedule Edge Functions with pg_cron.'
---
<div class="video-container">
<iframe
src="https://www.youtube-nocookie.com/embed/-U6DJcjVvGo"
frameBorder="1"
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
allowFullScreen
></iframe>
</div>
The hosted Supabase Platform supports the [`pg_cron` extension](/docs/guides/database/extensions/pgcron), a recurring job scheduler in Postgres.
In combination with the [`pg_net` extension](/docs/guides/database/extensions/pgnet), this allows us to invoke Edge Functions periodically on a set schedule.
<Admonition type="caution">
To access the auth token securely for your Edge Function call, we recommend storing them in [Supabase Vault](/docs/guides/database/vault).
</Admonition>
## Examples
### Invoke an Edge Function every minute
Store `project_url` and `publishable_key` in Supabase Vault:
```sql
select vault.create_secret('https://project-ref.supabase.co', 'project_url');
select vault.create_secret('YOUR_SUPABASE_PUBLISHABLE_KEY', 'publishable_key');
```
Make a POST request to a Supabase Edge Function every minute:
```sql
select
cron.schedule(
'invoke-function-every-minute',
'* * * * *', -- every minute
$$
select
net.http_post(
url:= (select decrypted_secret from vault.decrypted_secrets where name = 'project_url') || '/functions/v1/function-name',
headers:=jsonb_build_object(
'Content-type', 'application/json',
'apikey', (select decrypted_secret from vault.decrypted_secrets where name = 'publishable_key')
),
body:=concat('{"time": "', now(), '"}')::jsonb
) as request_id;
$$
);
```
## Resources
- [`pg_net` extension](/docs/guides/database/extensions/pgnet)
- [`pg_cron` extension](/docs/guides/database/extensions/pgcron)