Fix: Supabase Edge Function returning UNAUTHORIZED_NO_AUTH_HEADER for Steam OpenID callback

termux-supabase.md

Fix: UNAUTHORIZED_NO_AUTH_HEADER on Supabase Edge Function Steam OpenID Callback

Problem

When using a Supabase Edge Function as the openid.return_to target for Steam OpenID 2.0 authentication, Steam's redirect back to the function fails with:

{"code":"UNAUTHORIZED_NO_AUTH_HEADER","message":"Missing authorization header"}

This happens because Supabase Edge Functions have JWT verification enabled by default. Steam's redirect is a plain GET request with no Authorization header, so Supabase's middleware rejects it before the function code even runs.

Root Cause

Supabase enforces JWT auth on all Edge Functions unless explicitly disabled. The openid.return_to URL points directly to the Edge Function, so there is no opportunity for the client to attach a bearer token — Steam just redirects the browser there.

This issue can appear suddenly if the function is redeployed without --no-verify-jwt, or after a platform change that re-enables the default.

Fix

Option 1: Supabase Dashboard (no CLI or token required)

1. Go to your project → Edge Functions → steam-callback
2. Toggle off "Verify JWT" in the function settings

Option 2: Supabase Management API (curl)

Requires a personal access token from supabase.com/dashboard/account/tokens:

curl -s -X PATCH \
  "https://api.supabase.com/v1/projects/<PROJECT_REF>/functions/<FUNCTION_NAME>" \
  -H "Authorization: Bearer <YOUR_SUPABASE_PERSONAL_ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"verify_jwt": false}'

Confirm success by checking the response for "verify_jwt": false.

Option 3: Supabase CLI on deploy

supabase functions deploy steam-callback --no-verify-jwt --project-ref <PROJECT_REF>

Option 4: config.toml (persists across deploys)

Create supabase/functions/steam-callback/config.toml:

[functions.steam-callback]
verify_jwt = false

Then deploy normally. The CLI picks this up automatically.

Supabase CLI on Termux (Android ARM64) — Known Broken

The Supabase CLI cannot be used on Termux via either of the two obvious approaches:

Source build via go install fails

# google.golang.org/grpc/internal/transport
http_util.go:480:18: f.fr.ReadFrameHeader undefined (type *http2.Framer has no field or method ReadFrameHeader)
http_util.go:491:18: f.fr.ReadFrameForHeader undefined (type *http2.Framer has no field or method ReadFrameForHeader)

supabase/cli depends on google.golang.org/grpc@v1.80.0, which requires methods added to http2.Framer in a newer golang.org/x/net release. The version resolved by the CLI's go.mod on Termux doesn't include them.

Pre-built linux_arm64 binary fails

error: "/path/supabase" has unexpected e_type: 2

Android requires all executables to be PIE (Position Independent Executable, e_type 3 / ET_DYN). The official release binary is a standard ET_EXEC and is rejected by the Android kernel.

Workaround

Use the Management API or dashboard (Options 1–2 above). If you need the full CLI, run it inside a proper Linux ARM64 environment via proot-distro and install the .deb package there.

Notes

• The Edge Function itself handles identity verification via Steam OpenID's check_authentication mode — JWT verification at the Supabase layer is redundant and incompatible with this flow.
• The config.toml approach is recommended so the setting survives future redeploys.

References

• Supabase Edge Functions docs
• Supabase CLI
• Steam OpenID 2.0