JWT

JWT (JSON Web Token) is a signed, base64url-encoded token that carries auth claims — who the request is (sub, the user id) and what role it holds (role). Supabase Auth issues one on sign-in, and the client sends it as a Bearer token on every API and PostgREST request.

The token has three dot-separated parts: header, payload, signature. The payload holds the claims. Postgres reads them through auth.uid() and auth.jwt(), which is how RLS policies decide whether a row is visible:

create policy "owner reads own rows"
on public.notes for select
using (auth.uid() = user_id);

The signature is the part that matters. Supabase verifies the JWT against the project's JWT secret before trusting any claim — an expired or tampered token is rejected, and the request falls back to the anon key role. The service role key is itself a JWT with the service_role claim, which bypasses RLS entirely, so it stays server-side and never reaches the browser.

When you move to your own project, the JWT secret changes. Tokens issued by the old project stop validating on the new one, so existing sessions end and users sign in again — even though their password hashes carry over. Their user ids (sub) are preserved, so foreign keys and RLS policies keep working unchanged.