# Ensure Edge Functions verify JWT unless intentionally public

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103911122689-ensure-edge-functions-verify-jwt-unless-intentionally-public
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every Edge Function checks that the caller is authorized before it does any work. Either the platform JWT check (Enforce JWT Verification) must be enabled, or the function code must verify the user's token itself, for example with supabase.auth.getClaims(). Only intentionally public functions, such as webhooks, may skip this, and they must use their own checks such as a webhook signature.

**Rationale**

When a function has no JWT check and no authorization in its code, anyone on the internet can call it without signing in. If the function reads data, sends emails, or uses secret keys, an attacker could misuse it freely. Supabase now recommends verifying auth inside the function when using the new signing keys, so each function must be reviewed to make sure one of these checks is always in place.

**Impact**

-   Unauthorized requests are rejected
    
-   Reduces misuse of functions that use secrets
    
-   Public functions such as webhooks need their own checks
    

**Default Value**

By default, Enforce JWT Verification (verify\_jwt) is enabled for Edge Functions. It can be turned off in the function's Details tab, in config.toml, or with the --no-verify-jwt deploy flag.

**Pre-Requisites**

-   Project Owner, Admin, or Developer role
    
-   A list of functions that are intentionally public
    
-   Access to each function's source code
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Edge Functions in the sidebar and select each function.
    
4.  Open the Details tab and check whether Enforce JWT Verification is enabled.
    
5.  If it is disabled, review the function code and confirm that it verifies the caller (for example, with supabase.auth.getClaims() or a webhook signature check).
    
6.  If JWT verification is disabled and the code has no authorization check, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Edge Functions in the sidebar and select the function.
    
4.  Open the Details tab, enable Enforce JWT Verification, and save.
    
5.  To keep the setting on future deploys, set verify\_jwt = true under \[functions.<function-name>\] in supabase/config.toml.
    
6.  If the function must stay public or uses the new API keys, keep verification off but add an authorization check in the function code.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Edge Functions in the sidebar and select the function.
    
4.  Open the Details tab, disable Enforce JWT Verification, and save.
    
5.  Set verify\_jwt = false in supabase/config.toml so the next deploy keeps the setting.
    

**Reference**

-   [https://supabase.com/docs/guides/functions/auth](https://supabase.com/docs/guides/functions/auth)
    
-   [https://supabase.com/docs/guides/troubleshooting/edge-function-401-error-response](https://supabase.com/docs/guides/troubleshooting/edge-function-401-error-response)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.