AuthSessionMissingError: Auth session missing! (Supabase Auth)

Fix it yourself

Follow the repair

1. Find the exact call that throws. The stack trace or your logs will point to a line calling getUser() or exchangeCodeForSession(). Note which file it is and where that file runs — browser, server component, or API route — because the right fix depends entirely on which side of that line the code lives. Errors that appear only sometimes are usually the "too early" kind: the call races the sign-in and loses when the network is slow.
2. Ask for the session before asking for the user. getSession() does not throw when nobody is signed in — it calmly returns null. Use it as the gate, and only call getUser() once a session exists:

   const { data: { session } } = await supabase.auth.getSession();
   if (!session) {
     // Nobody is signed in here — show a login prompt or return early
     return null;
   }
   const { data: { user } } = await supabase.auth.getUser();

   This one change converts a crash into a normal, handleable state — and half the occurrences of this error are really just an app that never decided what "signed out" should look like.
3. Use one shared client, created the right way for its environment. Search the project for every createClient call. In the browser, there should be a single shared client (in Next.js, the createBrowserClient from @supabase/ssr, kept in one helper file that everything imports). On the server — route handlers, server components, server actions — use createServerClient from @supabase/ssr wired to the request's cookies. A plain @supabase/supabase-js client on the server has no access to the visitor's cookies and will report a missing session for every single visitor.
4. Check the client options where the session gets lost. If a client is created with custom auth options, look for persistSession: false or a custom storage setting pointing somewhere temporary. In the browser the defaults are what you want: the session persists across page loads and the client detects it automatically. Only change those defaults if you know exactly why.
5. If it happens during OAuth or email-link login, complete the exchange first. When a user returns from a Google login or a magic link, the session does not exist until the code in the URL has been exchanged for one. That exchange belongs in the callback route, and nothing that needs a user should run before it finishes:

   // In your auth callback route
   const code = searchParams.get("code");
   if (code) {
     const { error } = await supabase.auth.exchangeCodeForSession(code);
     if (!error) redirect("/dashboard");
   }

   If exchangeCodeForSession itself throws "session missing", the code was already used, expired, or the callback is being hit without one — send the user back to login with a friendly message instead of letting it crash.
6. Wait for auth to be ready before running protected code. In browser apps, gate the first user-dependent work on the auth state instead of firing it on page load: run it inside an onAuthStateChange listener, or after an explicit session check completes. Then test the real sequence — fresh browser, sign in, land on the page that used to crash — plus the signed-out sequence, opening the same page with no login at all. Both paths should now behave: one shows the user's data, the other shows a login prompt, and neither throws.