skills.rest
marvinbiss
marvinbissCOMMUNITY
Explore all skills by this author →
GitHub

supabase-extract-jwt

Extract and decode Supabase JWTs from client-side code, cookies, and local storage.

Updated Jan 31, 2026
Search Tags:#security#authentication#jwt#supabase#client-side#token
One-click install
npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-extract-jwt-marvinbiss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-extract-jwt
Source: https://github.com/marvinbiss/servicesartisans/tree/main/.cursor/skills/supabase-extract-jwt
Command: npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-extract-jwt-marvinbiss

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps identify and analyze JSON Web Tokens (JWTs) related to Supabase that might be exposed in client-side code, helping to detect potential security vulnerabilities.

Core Features & Use Cases

  • JWT Discovery: Finds JWTs within client-side JavaScript, cookies, and local storage patterns.
  • Token Analysis: Decodes JWTs to reveal claims like user ID, email, and expiration dates.
  • Security Detection: Flags hardcoded user tokens and potential exposure of sensitive keys.
  • Use Case: Automatically scan a web application to find any Supabase API keys or user tokens accidentally left in the source code, alerting you to potential security risks.

Quick Start

Extract and analyze all JWTs from https://myapp.example.com.

Frequently Asked Questions about supabase-extract-jwt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed Supabase JWTs in client-side code?▼

Yes, decoding Supabase JWTs allows you to analyze token claims, revealing embedded user IDs, emails, and expiration dates to evaluate potential security vulnerabilities and session validity.

What is the best way to scan a web application for hardcoded Supabase API keys?▼

Scanning a web application for hardcoded Supabase API keys involves pattern matching against common Supabase storage keys and JWT structures to alert you to accidentally exposed sensitive authentication tokens.

Can I extract JWTs from browser local storage and cookies for security analysis?▼

You can extract JWTs from browser local storage and cookies by analyzing client-side code patterns, matching common Supabase storage keys, and decoding the discovered tokens to inspect their security claims.

Does Supabase authentication store user tokens in local storage?▼

Supabase authentication typically stores user tokens in local storage and cookies, which can be extracted and decoded to reveal user claims, expiration dates, and potential hardcoded API key exposures.

How do I decode Supabase JWT claims like user ID and expiration date?▼

To decode Supabase JWT claims like user ID and expiration date, the token is extracted from client-side code and analyzed to reveal its embedded payload data and assess session validity.

Related Skills

Explore More Software Engineering Skills→
yoanbernabeuyoanbernabeu
62

supabase-extract-url

Extract Supabase project URLs from JavaScript, environment variables, and configuration files.

Community
Basic
JayRHaJayRHa
3

secrets-manager

Detect, prevent, and remediate leaked credentials across codebases.

Community
Advanced
marvinbissmarvinbiss

supabase-extract-service-key

Detect exposed Supabase service_role keys in client-side code.

Community
Advanced
yoanbernabeuyoanbernabeu
62

supabase-extract-jwt

Extracts and decodes Supabase JWTs from client-side code, cookies, and localStorage.

Community
Intermediate