createBrowserClient should not require getAll/setAll cookies when using 'tokens-only' flow

[wong2]

Description

When using createBrowserClient with the 'tokens-only' option, the getAll and setAll cookie methods are still required parameters. However, in the 'tokens-only' flow, session tokens are managed via getSession / setSession rather than cookies, so requiring cookie accessors is unnecessary and confusing.

Expected Behavior

createBrowserClient with 'tokens-only' should not require getAll and setAll cookie parameters, since the token-based flow bypasses cookie storage entirely.

// This should work without providing getAll/setAll
const supabase = createBrowserClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
  cookies: {
    encode: 'tokens-only',
  }
})

Current Behavior

TypeScript requires getAll and setAll to be provided even when using 'tokens-only', which forces users to pass in no-op stubs:

const supabase = createBrowserClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
  cookies: {
    encode: 'tokens-only',
    getAll: () => [], // unnecessary
    setAll: () => {}, // unnecessary
  },
})

[ylemkimon]

Actually, it still uses it for getting token and setting PKCE code verifiers. So the issue should be that getAll/setAll should be set to defaults when they are not set.

[mandarini]

Hi @wong2, thank you for opening this issue! Quick clarification on the behavior first: tokens-only doesn't bypass cookies. It only moves the user object to userStorage (defaults to localStorage). The session tokens themselves and the PKCE code verifiers still flow through the cookie methods, so passing no-op getAll/setAll stubs would silently break auth. @ylemkimon's comment above is correct on that point.

That said, the underlying ergonomic complaint is fair. createBrowserClient already falls back to document.cookie automatically when you omit the cookies option entirely, but because encode lives on the cookies object, opting into tokens-only forced you to redeclare getAll/setAll even though the library would happily use the same fallback.

I have a fix on the way that makes getAll/setAll optional on the browser client. When both are omitted, the existing document.cookie fallback kicks in. So this will work as you originally wrote it.

[wong2]

Thanks!