Why auth.uid() returns null in Supabase RLS when using Clerk

Supabase RLS helpers like auth.uid() read claims from the JWT attached to the request. Clerk's session token is a valid JWT for Clerk — not for Supabase. If you pass getToken() straight into createClient({ global: { headers: { Authorization }}}) without minting a Supabase-shaped token (or enabling Clerk as a third-party auth provider), PostgREST accepts the connection as anon and auth.uid() resolves to null. The seam is the audience/issuer mismatch, not your RLS SQL.

import { auth } from "@clerk/nextjs/server";
import { createClient } from "@supabase/supabase-js";
import { SignJWT } from "jose";

export async function createClerkSupabaseClient() {
  const { userId } = await auth();
  if (!userId) throw new Error("not signed in");

  const secret = new TextEncoder().encode(process.env.SUPABASE_JWT_SECRET!);
  const token = await new SignJWT({ role: "authenticated" })
    .setProtectedHeader({ alg: "HS256", typ: "JWT" })
    .setSubject(userId)
    .setIssuedAt()
    .setExpirationTime("1h")
    .sign(secret);

  return createClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    { global: { headers: { Authorization: `Bearer ${token}` } } }
  );
}