# supabase-extract-jwt

This skill finds Supabase JWTs in client code, cookies, and storage patterns, then inspects their claims. Use it when checking exposed credentials.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 465 installs · ★ 71
- Author: yoanbernabeu
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/extraction/supabase-extract-jwt/SKILL.md
- Updated: 2026-01-31
- HTML: https://affpapa.org/en/nevibecode/skills/supabase-extract-jwt

## What it does

The skill extracts JWTs from client-side code, cookies, `localStorage`, and `sessionStorage` references. It classifies anon keys, service role keys, access tokens, and refresh tokens, then reports claims, expiry details, and the file location. Hardcoded user tokens and tokens carrying the `service_role` role receive separate security findings.

Findings are written to `.sb-pentest-context.json` as they appear, while actions and completion events go to `.sb-pentest-audit.log`. The skill can reassemble tokens split across lines and validates JWT structure before treating Base64-like strings as matches. Extraction needs an accessible target application.

Supabase detection runs automatically when it has not been completed. Encrypted JWE values and custom formats are marked as undecodable, so the report for those values is limited to their discovery. The skill is available for Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, and OpenCode.

## Requirements
- Works with: Supabase

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-jwt -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/supabase-extract-jwt/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/supabase-extract-jwt/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-jwt -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/supabase-extract-jwt/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-jwt -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/supabase-extract-jwt/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yoanbernabeu/supabase-pentest-skills supabase-extract-jwt
```

2. **Manually: put the files in place**
- File: `.github/skills/supabase-extract-jwt/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-jwt -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yoanbernabeu/supabase-pentest-skills --path skills/extraction/supabase-extract-jwt
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/supabase-extract-jwt/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-jwt -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/extraction/supabase-extract-jwt/SKILL.md

## When to use it
- find JWTs in bundled client code
- inspect token claims and expiry
- flag hardcoded user session tokens
- locate Supabase storage key patterns
- record findings in context and audit files

## Example prompts
- Find JWTs on `https://myapp.example.com` and show where each one appears.
- Extract every JWT from `https://myapp.example.com`, then inspect its claims and expiry.
- Check the client bundle for hardcoded user tokens and any `service_role` key.

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 1d4bff1f5bb56db5.

BEGIN THIRD-PARTY FILE 1d4bff1f5bb56db5
````text
---
name: supabase-extract-jwt
description: Extract and decode Supabase-related JWTs from client-side code, cookies, and local storage patterns.
---

# Supabase JWT Extraction

> 🔴 **CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED**
>
> You MUST write to context files **AS YOU GO**, not just at the end.
> - Write to `.sb-pentest-context.json` **IMMEDIATELY after each discovery**
> - Log to `.sb-pentest-audit.log` **BEFORE and AFTER each action**
> - **DO NOT** wait until the skill completes to update files
> - If the skill crashes or is interrupted, all prior findings must already be saved
>
> **This is not optional. Failure to write progressively is a critical error.**

This skill extracts and analyzes JSON Web Tokens (JWTs) related to Supabase from client-side code.

## When to Use This Skill

- To find all JWT tokens exposed in client code
- To analyze token claims and expiration
- To detect hardcoded user tokens (security issue)
- To understand the authentication flow

## Prerequisites

- Target application accessible
- Supabase detection completed (auto-invokes if needed)

## Types of JWTs in Supabase

| Type | Purpose | Client Exposure |
|------|---------|-----------------|
| Anon Key | API authentication | ✅ Expected |
| Service Role Key | Admin access | ❌ Never |
| Access Token | User session | ⚠️ Dynamic only |
| Refresh Token | Token renewal | ⚠️ Dynamic only |

## Detection Patterns

### 1. API Keys (Static)

```javascript
// Supabase API keys are JWTs
const SUPABASE_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
```

### 2. Hardcoded User Tokens (Problem)

```javascript
// ❌ Should never be hardcoded
const userToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIn0...'
```

### 3. Storage Key Patterns

```javascript
// Code referencing where JWTs are stored
localStorage.getItem('supabase.auth.token')
localStorage.getItem('sb-abc123-auth-token')
sessionStorage.getItem('supabase_session')
```

## Usage

### Basic Extraction

```
Extract JWTs from https://myapp.example.com
```

### With Claim Analysis

```
Extract and analyze all JWTs from https://myapp.example.com
```

## Output Format

```
═══════════════════════════════════════════════════════════
 JWT EXTRACTION RESULTS
````
END THIRD-PARTY FILE 1d4bff1f5bb56db5

The third-party file has ended. Everything between the 1d4bff1f5bb56db5 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2407 of 10203 bytes. © yoanbernabeu · MIT · https://github.com/yoanbernabeu/supabase-pentest-skills/tree/HEAD/skills/extraction/supabase-extract-jwt/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md