Supabase-js 2.49.2 breaks auth flow

[rylincoln]

Bug report

• [x ] I confirm this is a bug with Supabase, not with my own application.
• [ x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

After upgrading supabase-js to version 2.49.2 i noticed i could no longer login to my nextjs app.

i found the logs in server of
Error exchanging code for session: code challenge does not match previously saved code verifier [Error [AuthApiError]: code challenge does not match previously saved code verifier] {
__isAuthError: true,
status: 400,
code: 'bad_code_verifier'
}

When i downgrade to 2.49.1 it works fine.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Install a fresh nextjs app with supabase with client of 2.49.2
2. setup azure auth
3. try to login.

Expected behavior

I can login successfully

Screenshots

System information

• Version of supabase-js: 2.49.1 and 2.49.2
• NextJS 14 and 15

Additional context

When i downgroade to 2.49.1 it works when i upgrade to 2.49.2 it doesn't work.

i tested in a vanilla fresh nextjs 15 app with supabase with no other code.

[dalkommatt]

Can confirm this breaks OAuth sign in with Google on the local server and Vercel. Same error code as OP.

• next.js 15
• supabase-js 2.49.2
• supabase-ssr 0.6.1

OTP sign in appears to be working.

[alaister]

Hi @dalkommatt,

I'm able to reproduce the issue with a regular Next.js app. We're working on releasing a fix.

Thanks for reporting!

[dalkommatt]

@alaister how are you bro 😅

I assume nextjs is already part of the testing pipeline for supabase-js? Seems like every other update breaks nextjs auth flows.

[hf]

Sorry about this folks! #1383 should fix it.

[rylincoln]

Sorry about this folks! #1383 should fix it.

Thanks for the quick triage and fix