Server: extractCredentials

Extracts authentication credentials from an incoming HTTP request.

Reads two headers:

• Authorization: Bearer <token> → extracted as token
• apikey: <key> → extracted as apikey

This is a pure extraction step — no validation or verification is performed. Pass the result to verifyCredentials to validate against allowed auth modes.

Parameters

• request

  (Required)

  The incoming HTTP request.

Examples

Basic usage

import { extractCredentials } from '@supabase/server/core'

const creds = extractCredentials(request)
console.log(creds.token)  // "eyJhbGci..." or null
console.log(creds.apikey) // "sb-abc123-publishable-..." or null