How to fix bad_json: HTTP body could not be parsed as JSON in Supabase

# Validate JSON with jq
echo '{"email": "[email protected]", "password": "secret",}' | jq empty

# Or use Python's json.tool
python3 -m json.tool <<< '{"email": "[email protected]", "password": "secret"}'

# Online validators like jsonlint.com

// Correct headers for fetch API
const response = await fetch('https://your-project.supabase.co/auth/v1/signup', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'apikey': 'YOUR_ANON_KEY'
  },
  body: JSON.stringify({
    email: '[email protected]',
    password: 'secure-password'
  })
});

// Using curl
curl -X POST https://your-project.supabase.co/auth/v1/signup \
  -H "Content-Type: application/json" \
  -H "apikey: YOUR_ANON_KEY" \
  -d '{"email": "[email protected]", "password": "secure-password"}'

import { createClient } from '@supabase/supabase-js';

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

// Let the client handle JSON serialization
const { data, error } = await supabase.auth.signUp({
  email: '[email protected]',
  password: 'secure-password'
});

if (error) {
  console.error('Auth error:', error.message);
  // Error will be more descriptive than "bad_json"
}

// Other auth methods that handle JSON correctly
const { data: signInData, error: signInError } = await supabase.auth.signInWithPassword({
  email: '[email protected]',
  password: 'secure-password'
});

const { data: sessionData, error: sessionError } = await supabase.auth.getSession();

// Bad: BOM (Byte Order Mark) at start - common in files saved with BOM
const badJson = '{"email": "[email protected]"}';

// Bad: Unescaped quotes within strings
const badJson2 = '{"message": "He said "hello""}';

// Good: Properly escaped quotes
const goodJson = '{"message": "He said \"hello\""}';

// Check for BOM
function hasBOM(str) {
  return str.charCodeAt(0) === 0xFEFF;
}

// Remove BOM if present
function removeBOM(str) {
  if (str.charCodeAt(0) === 0xFEFF) {
    return str.slice(1);
  }
  return str;
}

# Start with minimal valid JSON for signup
curl -X POST https://your-project.supabase.co/auth/v1/signup \
  -H "Content-Type: application/json" \
  -H "apikey: YOUR_ANON_KEY" \
  -d '{}'  # This will fail with different error (missing fields)

# Add required fields one at a time
curl -X POST https://your-project.supabase.co/auth/v1/signup \
  -H "Content-Type: application/json" \
  -H "apikey: YOUR_ANON_KEY" \
  -d '{"email": "[email protected]"}'

curl -X POST https://your-project.supabase.co/auth/v1/signup \
  -H "Content-Type: application/json" \
  -H "apikey: YOUR_ANON_KEY" \
  -d '{"email": "[email protected]", "password": "secret"}'

# Test other endpoints
curl -X POST https://your-project.supabase.co/auth/v1/token \
  -H "Content-Type: application/json" \
  -H "apikey: YOUR_ANON_KEY" \
  -d '{"email": "[email protected]", "password": "secret", "grant_type": "password"}'

// Common middleware issues:
// 1. Body parsers that convert JSON to other formats
// 2. Compression middleware that corrupts payload
// 3. Security scanners that modify requests
// 4. Proxy servers that change encoding

// Debug by logging the exact request being sent
console.log('Request body:', JSON.stringify(payload));
console.log('Request headers:', headers);

// Compare what you send vs what Supabase receives
// Enable network logging in browser DevTools or use tools like:
// - Wireshark for packet inspection
// - Charles Proxy for HTTP debugging
// - Browser Network tab for web apps

// If using a proxy, check its configuration:
// - Ensure it preserves Content-Type: application/json
// - Verify it doesn't modify the request body
// - Check for request/response transformations