Supabase incident

S3 endpoints for keys with special characters broken

Minor Resolved View vendor source →

Supabase experienced a minor incident on July 16, 2026 affecting Storage, lasting 53m. The incident has been resolved; the full update timeline is below.

Started
Jul 16, 2026, 05:55 PM UTC
Resolved
Jul 16, 2026, 06:49 PM UTC
Duration
53m
Detected by Pingoru
Jul 16, 2026, 05:55 PM UTC

Affected components

Storage

Update timeline

  1. identified Jul 16, 2026, 05:55 PM UTC

    We have identified an issue where S3 endpoints for keys with special characters will be broken. We are actively investigating the correct mitigation for this issue.

  2. identified Jul 16, 2026, 06:23 PM UTC

    A likely mitigation has been identified and we are discussing the proper implementation method.

  3. identified Jul 16, 2026, 06:32 PM UTC

    We have implemented a PR rollback to mitigate this issue. We will actively monitor its progress

  4. resolved Jul 16, 2026, 06:49 PM UTC

    This incident has been resolved. A recent API Gateway deployment altered how certain special characters in S3 object key paths were encoded before reaching storage, causing signature verification failures (403) for affected requests. The change has been reverted and issue is now fixed.