@supabase/auth-helpers to @supabase/ssr

Supabase auth-helpers to @supabase/ssr Migration: free score in 10 seconds

Paste a route, middleware or component. See every deprecated auth-helpers call with a Readiness Score. The bundle swaps them for @supabase/ssr.

✓ Runs 100% in your browser✓ Free score, no signup✓ Instant download after checkout✓ Free terminal scanner

🕹️ Try It Right Now in Your Browser

A realistic broken sample is preloaded. Nothing is uploaded: the scan runs in this tab.

$python3 <(curl -sL https://thorp-tools.pages.dev/starters/supabase-ssr-scan.py)

Or scan your whole repo from the terminal (Python 3, stdlib only, reads files locally).

Before: deprecated helpers
import { createMiddlewareClient } from '@supabase/auth-helpers-nextjs'
const supabase = createMiddlewareClient({ req, res })
After: @supabase/ssr
import { createServerClient } from '@supabase/ssr'
const supabase = createServerClient(url, key, { cookies })
$19$9one-time, no subscription. 10-second fix bundle. Get the fix bundle

100% Working Patch Guarantee — full refund if it doesn't pass your build check
Refund requests: open a Discussion at thorp-tools.pages.dev

The math: Hand-porting cookies handling across middleware, routes and server components takes 2 to 4 hours. At $75/h that is $150+. The bundle is $9.

Key Takeaways

  • @supabase/auth-helpers is deprecated; @supabase/ssr replaces it with explicit cookie handling.
  • Most errors come from missing getAll/setAll cookie methods and middleware that never refreshes the session.
  • The free checker finds each auth-helpers import; the $9 bundle rewrites them and adds a working middleware.

Free instant diagnostic: your Readiness Score

What the $9 bundle contains

  • Codemod for auth-helpers imports and client factories
  • Cookie adapter templates for middleware and route handlers
  • AI repair prompts
  • Checklist

Who this is NOT for

  • Teams with a dedicated platform engineer who already scripted this migration
  • Anyone who enjoys reading changelogs line by line
  • Repos that the free score already rates 100/100

Supabase SSR migration: this bundle vs by hand

This toolManual / ChatGPT
Finds every issueYes, file and lineMisses files you did not paste
TimeAbout 10 seconds1 to 3 hours
CostOne-time feeYour hourly rate
Runs offlineYesNo

Run Free 10-Second Terminal Scan

Paste this in your project folder. One Python 3 file, standard library only, nothing is uploaded. It checks for old @supabase/auth-helpers code and cookie methods and prints a 0-100 score.

python3 <(curl -sL https://thorp-tools.pages.dev/starters/supabase-ssr-scan.py) .
View the script

@supabase/ssr: which option is best suited for you

OptionBest Suited ForCost
Free checker on this pageFinding every auth-helpers import fastFree
$9 fix bundleNext.js teams who want the codemod, middleware template and checklist$9 one-time
Supabase docs by handSmall apps with one or two auth filesFree, 1-3 hours
Staying on auth-helpersApps you are about to retireFree, unsupported

⚡ Building a dev tool? Get featured in our comparison table & GitHub Wiki ($49) →

Exact errors this fixes

Module not found: Can't resolve '@supabase/auth-helpers-nextjs'

The package is deprecated. The codemod moves you to @supabase/ssr.

AuthSessionMissingError: Auth session missing!

Usually a missing cookies adapter after migration. The bundle ships the correct adapter.

@supabase/auth-helpers-nextjs is deprecated → @supabase/ssr

For Next.js teams: migrate Supabase auth-helpers to @supabase/ssr today.

Paste your code and instantly see every deprecated createClientComponentClient, createServerComponentClient, createRouteHandlerClient, createMiddlewareClient and Pages Router call, with the exact createBrowserClient / createServerClient (getAll/setAll) replacement. Free, 100% in your browser.

Run the free check ↓Get the fix bundle — $9
Rules sourced from the official Supabase docs · App Router + Pages Router · Next.js 13–16 · nothing leaves your browser

Free checker

Paste any mix of package.json, components, route handlers, server actions, middleware.ts / proxy.ts or getServerSideProps. Click check.

Before → after (what --fix does)

Before · auth-helpers

import { cookies } from 'next/headers'import { createServerComponentClient }  from '@supabase/auth-helpers-nextjs' export default async function Page() {  const cookieStore = cookies()  const supabase = createServerComponentClient({    cookies: () => cookieStore,  })

After · @supabase/ssr

import { createClient } from '@/lib/supabase/server'  export default async function Page() {  const supabase = await createClient()  // lib/supabase/server.ts (generated):  // createServerClient(url, key, { cookies: {  //   getAll: () => cookieStore.getAll(),  //   setAll: (c) => { try { c.forEach(...) } catch {} } } })

The pack also writes lib/supabase/client.ts, server.ts, proxy.ts (session refresh with getClaims() and cache headers), a Pages Router helper, and a middleware.ts or proxy.ts entry that matches your Next.js version.

Why not just do it by hand?

Silent sign-outs

Return the wrong response from middleware or refresh in two places and users are logged out at random. The templates follow Supabase's exact proxy pattern.

Next 15 vs 16

proxy.ts on Next ≤15 is never called; middleware.ts on 16 is renamed. The CLI reads your next version and writes the right one.

Async cookies

cookies() is async in Next 15+. Every server call becomes await createClient(), but only inside async functions (the rest are flagged, never broken).

getSession() on the server

Supabase says never trust it in server code. Every server-side getSession() is flagged with the getClaims() replacement.

Supabase Auth Helpers → @supabase/ssr Migration Pack

  • Codemod CLI (node cli.js . --fix): rewrites browser, server-component, route-handler, server-action and Pages Router clients; moves types to supabase-js; cleans cookies() imports; updates package.json. .bak backups, --dry-run diff.
  • Generated templates (TS + JS): client, server, proxy/updateSession, Pages Router server-props, middleware/proxy entry. TS templates type-check against @supabase/ssr 0.12.7.
  • CI gate + reports: --ci exits 1 until you're done, --json, --md checklist report.
  • 16-step migration checklist + 20 regression tests + fixtures, every rule linked to the Supabase docs.
$9 one-time · USD

Instant download: after checkout you're redirected straight to your private download page. Zero dependencies, runs locally on Node 18+.

Get the 10-Second Fix Bundle — $9

Questions or problems with your download? Contact us via GitHub issues.

Methodology

The free checker runs entirely in your browser: it matches the text you paste against rules written from the official changelogs and migration guides. Nothing is uploaded. The paid deliverables are files (codemod, templates, checklist) unlocked right after checkout; each pack is tested against the fixtures shipped inside it.

Sources and free assets: GitHub release · GitHub Wiki guide. Contact and support: open a Discussion at thorp-tools.pages.dev.

Last Updated:

FAQ

Is @supabase/auth-helpers-nextjs deprecated?

Yes. The npm package (latest 0.15.0) is marked "Package no longer supported", and Supabase consolidated all auth-helpers packages into @supabase/ssr. Supabase recommends migrating because fixes and features only land in @supabase/ssr.

What replaces createClientComponentClient and createServerComponentClient?

createClientComponentClient becomes createBrowserClient; createServerComponentClient, createRouteHandlerClient and createServerActionClient become createServerClient with a cookies object that implements getAll and setAll; createMiddlewareClient becomes createServerClient inside an updateSession() proxy/middleware that calls supabase.auth.getClaims().

Can I keep both packages installed during the migration?

Supabase says not to use auth-helpers-nextjs and @supabase/ssr in the same application, because it causes authentication issues. Migrate every file, then uninstall the helpers.

Does it support the Pages Router?

Yes. createPagesBrowserClient becomes the browser client, and createPagesServerClient / createServerSupabaseClient become a createServerClient that reads cookies with parseCookieHeader and writes them with serializeCookieHeader.

What about Next.js 16 and proxy.ts?

Next.js 16 renamed middleware.ts to proxy.ts (export async function proxy). On Next.js 15 and earlier a proxy.ts is never called, so sessions never refresh. The checker flags both mistakes, and the pack writes the right file for your Next.js version.

Should I still use getSession() on the server?

No. Supabase: never trust getSession() in server code such as the proxy, because it reads the cookie without revalidating it. Use getClaims() to protect pages and data, or getUser() when you need a fresh user record.

Is my code uploaded anywhere?

No. This free checker runs entirely in your browser. The paid pack is a zero-dependency Node.js CLI that runs locally on your repo.

How do I get the pack after paying?

Instantly: after checkout Stripe redirects you to your private download page (the unlock key is in the link). Save the link; it is your copy.

Free starter files: GitHub Releases