Repository navigation
fix(supabase): recommend scoped personal access tokens for the Management API, CLI, and MCP - #604
Merged
Merged
Conversation
…ment API, CLI, and MCP The skill had no guidance on personal access tokens, so agents setting up Management API scripts, CLI in CI, or the MCP server without OAuth tended to suggest a classic token with full account access. Scoped personal access tokens limit a token to chosen organizations, projects, and permissions. Changes to skills/supabase/SKILL.md: - Security checklist: prefer scoped personal access tokens for scripts, CI, and agents, and look up required permissions in the personal access tokens guide instead of guessing. No endpoint-to-permission mapping is copied into the skill, so it can't drift from the docs. - CLI gotchas: the browser flow of `supabase login` creates a classic token. In CI, set SUPABASE_ACCESS_TOKEN to a scoped token, which takes precedence over a saved login. Commands that connect with the database password (for example `supabase db push` with SUPABASE_DB_PASSWORD) aren't limited by the token's permissions. - MCP troubleshooting: where the browser OAuth flow can't run, pass a scoped token in the Authorization header. New step 4 explains the "You do not have permission to perform this action" error a scoped token returns when it lacks a tool's permission or the project is outside its scope.
Rodriguespn
approved these changes
Sep 24, 2026
Rodriguespn
left a comment
Rodriguespn
left a comment
Collaborator
There was a problem hiding this comment.
lgtm. Thanks @w3b6x9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The skill had no guidance on personal access tokens, so agents setting up Management API scripts, CLI in CI, or the MCP server without OAuth tended to suggest a classic token with full account access. Scoped personal access tokens limit a token to chosen organizations, projects, and permissions.
Changes to skills/supabase/SKILL.md:
supabase logincreates a classic token. In CI, set SUPABASE_ACCESS_TOKEN to a scoped token, which takes precedence over a saved login. Commands that connect with the database password (for examplesupabase db pushwith SUPABASE_DB_PASSWORD) aren't limited by the token's permissions.