Users get logged out when they refresh the page

What you see. Users sign in fine, but pressing refresh or opening a new tab sends them straight back to the login page.

Why it happens

A Supabase session is an access token that lives about one hour plus a refresh token that fetches a new one. In a plain browser app the client library keeps both and refreshes them. In a Next.js App Router app, which is what v0 generates, pages render on the server first. The server cannot see a session stored only in the browser, so it treats the visitor as signed out and redirects.

Supabase's answer is the @supabase/ssr package, which stores the session in cookies and uses a proxy.ts file (formerly middleware.ts) to refresh expired tokens on every request. Supabase notes that if that file never runs, sessions do not refresh and users get signed out. Agents often mix the browser client and the server client, or skip the proxy file, so the app works for an hour and then drops everyone. A related trap is trusting getSession() on the server. Supabase warns it reads the cookie without revalidating it.

Fix it yourself

1. Sign in, then refresh. If you are logged out at once, the server cannot see the session. If it happens after about an hour, token refresh is missing.
2. Search the code for createClient. A Next.js app needs two versions from @supabase/ssr, a browser client and a server client.
3. Check for a proxy.ts or middleware.ts file at the project root that calls supabase.auth.getClaims() and copies the refreshed cookies onto the response.
4. Ask the agent to follow the Supabase Next.js server-side auth guide exactly, and to replace getSession() in server code with getClaims() or getUser().
5. Redeploy and test in a private window, including a refresh after more than an hour.

When to get an engineer

Stop here if you are not comfortable editing the auth files, because a mistake can lock everyone out or let a stale session through. Tell the engineer the Next.js version, whether the app uses the App Router, and when the logout happens, at once or after an hour. A single fix at €99–$990 usually covers it in 1–3 days. If sign-in was hand-built instead of using a library, budget for cleanup at $1,500–$15,000.

Check these

Questions

Is this a Supabase outage?

Almost never. Supabase keeps the session on its side. The problem is that your app's server rendering cannot read or refresh the session stored in the browser.

Why does it work for an hour and then stop?

Access tokens expire after one hour by default. Without the proxy file refreshing them in cookies, the expired token is all the server sees, so it treats the user as signed out.

Sources: Supabase: Server-side auth for Next.js; Supabase: User sessions; Next.js: Authentication guide.