Subscribing to broadcasts does not work with the new non-JWT publishable keys

[GregoryHouseMD]

Only tested in local. Previously I used setAuth() before subscribing and it was working
await supabase.realtime.setAuth();

Now, this is what I get in console when I try to subscribe to a channel:

WebSocket connection to 'ws://127.0.0.1:54321/realtime/v1/websocket?apikey=sb_publishable_blahblahblahblahblahblabh&vsn=1.0.0' failed:

From the docker container, looks like it's expecting a JWT instead. But of course this is just my guess:

2025-10-06 15:09:38

Serializer: Phoenix.Socket.V1.JSONSerializer
2025-10-06 15:09:38

Parameters: %{"apikey" => "[FILTERED]", "log_level" => "[FILTERED]", "vsn" => "[FILTERED]"}
2025-10-06 15:09:41

19:09:41.012 project=realtime-dev external_id=realtime-dev error_code=MalformedJWT [error] MalformedJWT: The token provided is not a valid JWT
2025-10-06 15:09:41

19:09:41.012 project=realtime-dev external_id=realtime-dev [info] REFUSED CONNECTION TO RealtimeWeb.UserSocket in 424µs
2025-10-06 15:09:41

Transport: :websocket
2025-10-06 15:09:41

Serializer: Phoenix.Socket.V1.JSONSerializer
2025-10-06 15:09:41

Parameters: %{"apikey" => "[FILTERED]", "log_level" => "[FILTERED]", "vsn" => "[FILTERED]"}
2025-10-06 15:09:43

19:09:43.557 request_id=GGv8kghlMIrHAlwAAHXB [info] HEAD /api/ping
2025-10-06 15:09:43

19:09:43.557 request_id=GGv8kghlMIrHAlwAAHXB [info] Replica region not found, defaulting to Realtime.Repo
2025-10-06 15:09:43

19:09:43.558 request_id=GGv8kghlMIrHAlwAAHXB project=realtime-dev external_id=realtime-dev [info] Sent 200 in 1ms
2025-10-06 15:09:44

19:09:44.405 project=realtime-dev external_id=realtime-dev error_code=MalformedJWT [error] MalformedJWT: The token provided is not a valid JWT
2025-10-06 15:09:44

19:09:44.406 project=realtime-dev external_id=realtime-dev [info] REFUSED CONNECTION TO RealtimeWeb.UserSocket in 535µs
2025-10-06 15:09:44

Transport: :websocket
2025-10-06 15:09:44

Serializer: Phoenix.Socket.V1.JSONSerializer
2025-10-06 15:09:44

Parameters: %{"apikey" => "[FILTERED]", "log_level" => "[FILTERED]", "vsn" => "[FILTERED]"}
2025-10-06 15:09:46

19:09:46.812 project=realtime-dev external_id=realtime-dev error_code=MalformedJWT [error] MalformedJWT: The token provided is not a valid JWT
2025-10-06 15:09:46

19:09:46.812 project=realtime-dev external_id=realtime-dev [info] REFUSED CONNECTION TO RealtimeWeb.UserSocket in 238µs
2025-10-06 15:09:46

Transport: :websocket
2025-10-06 15:09:46

Serializer: Phoenix.Socket.V1.JSONSerializer
2025-10-06 15:09:46

Parameters: %{"apikey" => "[FILTERED]", "log_level" => "[FILTERED]", "vsn" => "[FILTERED]"}
2025-10-06 15:09:48

19:09:48.623 project=realtime-dev external_id=realtime-dev error_code=MalformedJWT [error] MalformedJWT: The token provided is not a valid JWT
2025-10-06 15:09:52

19:09:52.795 [info] Replica region not found, defaulting to Realtime.Repo
2025-10-06 15:09:52

19:09:52.799 project=realtime-dev external_id=realtime-dev error_code=MalformedJWT [error] MalformedJWT: The token provided is not a valid JWT
2025-10-06 15:09:52

19:09:52.799 project=realtime-dev external_id=realtime-dev [info] REFUSED CONNECTION TO RealtimeWeb.UserSocket in 4ms

[IceIsFrozen]

I've tried quite a few things now in an attempt to get around this issue, ideas that likely wouldn't have any chance of working but got to try!

• Passing a generated JWT via the config.toml but this breaks overall authentication...and doesn't get past the error.
  -- Maybe I'm doing something wrong, should this still be doable?
  -- Encoding my sb_publishable_yyyyyyyyyyyyy and secret key to JWT in every possible method or combination I could guess at
• Resetting everything locally
• Latest CLI and Supabase JS as of a few days ago
• Different users on different types of auth used Google / Email.
• Along side the typical troubleshooting steps for Realtime, such as ensuring all the tables are published, RLS permissions are all correct, trying different local addresses.

If I point my local setup to my production live supabase, works flawlessly. I don't have many changes so my databases and setup, are easy to verify along with supabase db diff that they are the same in every possible setting I can set/see.

[edgurgel]

Hey @IceIsFrozen, we are working on a fix!