> ## Documentation Index
> Fetch the complete documentation index at: https://squad.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Supabase
> What agents can do in Supabase at each access level, and how to connect, limit, and disconnect Supabase.
Connect Supabase so your agents can work in your Supabase account. You choose an access level for each account, and Squad refuses any agent action outside that level.
## Access levels
Each Supabase account has an access level: **Read-only** and **Read + write**. Squad refuses any agent action outside that level. You can also narrow or block single agents under **Per-agent access**.
| Level | The connect window describes this level as | Actions agents can use |
| ------------------------------ | ------------------------------------------------------ | ---------------------- |
| **Read-only** | "Read project, org info, auth config, DB metadata." | 65 of 128 |
| **Read + write** (recommended) | "Read/write project settings, DB schema, auth config." | 114 of 128 |
**Read + write** is the recommended level. The connect window selects it for you, and you can choose another level.
The Supabase sign-in page asks you to approve full access to your account. This is expected. Squad does not narrow the sign-in. It checks every agent action against the level you chose, and it refuses actions outside that level.
## What agents can do at each level
Each level opens with a short summary in plain tasks, then lists every action it adds, grouped by what the action works on. You do not need to name actions. Ask in plain words, and the agent searches for the matching action.
**Find an action.** Open a level and use your browser's find (Ctrl+F, or Cmd+F on a Mac) with a word from the task or part of a slug. Or ask your agent in plain words, for example "What can you do in my Supabase account?" The agent can search the Supabase actions for you.
Each action shows its name, a one-line description where the Supabase action catalog has one, and its slug. The slug is the ID that agents use when they call the action.
Agents can use 65 of the 128 Supabase actions at this level:
* View and create settings
* View keys
* View branches
* View functions
* View integrations
* View logs
* View organizations
* View projects
* View runs
* View snippets
* View availability
* View backups
All 65 actions at this level:
| Action | What it does | Slug |
| ---------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------- |
| Beta check vanity subdomain availability | Checks if a specific vanity subdomain is available for a Supabase project. | `SUPABASE_BETA_CHECK_VANITY_SUBDOMAIN_AVAILABILITY` |
| Action | What it does | Slug |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------- |
| List backups | Lists all database backups for a Supabase project, providing details on existing backups but not creating new ones or performing restores. | `SUPABASE_LIST_BACKUPS` |
| Action | What it does | Slug |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
| Get branch | Retrieves detailed information about a specific database branch by its name and project reference. | `SUPABASE_GET_BRANCH` |
| List branches | | `SUPABASE_LIST_BRANCHES` |
| List database branches | Lists all database branches for a specified Supabase project, used for isolated development and testing of schema changes. | `SUPABASE_LIST_DATABASE_BRANCHES` |
| Action | What it does | Slug |
| --------------------- | --------------------------------------------- | -------------------------------- |
| Get database metadata | Gets database metadata for the given project. | `SUPABASE_GET_DATABASE_METADATA` |
| Action | What it does | Slug |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
| Get function | Retrieves detailed information, metadata, configuration, and status for a specific Edge Function using its project reference ID and function slug. | `SUPABASE_GET_FUNCTION` |
| Get function body | Retrieves the source code (body) for a specified serverless Edge Function using its project reference and function slug. | `SUPABASE_GET_FUNCTION_BODY` |
| List functions | Lists metadata for all Edge Functions in a Supabase project (specified by 'ref'), excluding function code or logs. | `SUPABASE_LIST_FUNCTIONS` |
| Action | What it does | Slug |
| ---------------------- | --------------------------------------------------------------------------------- | --------------------------------- |
| List migration history | Retrieves the list of applied database migration versions for a Supabase project. | `SUPABASE_LIST_MIGRATION_HISTORY` |
| Action | What it does | Slug |
| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
| Alpha get third party integration | Retrieves the detailed configuration for a specific third-party authentication (TPA) provider, identified by tpa\_id, within an existing Supabase project specified by ref. | `SUPABASE_ALPHA_GET_THIRD_PARTY_INTEGRATION` |
| Alpha list third party auth integrations | Lists all configured third-party authentication provider integrations for an existing Supabase project (using its ref), suitable for read-only auditing or verifying current authentication settings. | `SUPABASE_ALPHA_LIST_THIRD_PARTY_AUTH_INTEGRATIONS` |
| Action | What it does | Slug |
| --------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------- |
| Get legacy signing key | Retrieves the signing key information for the JWT secret imported as signing key for this project. | `SUPABASE_GET_LEGACY_SIGNING_KEY` |
| Get project API key | Retrieves details of a specific API key for a Supabase project by its UUID. | `SUPABASE_GET_PROJECT_API_KEY` |
| Get project API keys | Retrieves all API keys for an existing Supabase project, specified by its unique reference ID (ref). | `SUPABASE_GET_PROJECT_API_KEYS` |
| Get project legacy API keys | Checks whether JWT-based legacy API keys (anon, service\_role) are enabled for a Supabase project. | `SUPABASE_GET_PROJECT_LEGACY_API_KEYS` |
| Get project signing keys | List all signing keys for a Supabase project. | `SUPABASE_GET_PROJECT_SIGNING_KEYS` |
| Action | What it does | Slug |
| ------------------- | ----------------------------------------------------------------- | ------------------------------ |
| Get action run logs | Retrieves the execution logs for a specific action run by its ID. | `SUPABASE_GET_ACTION_RUN_LOGS` |
| Get project logs | Retrieves analytics logs for a Supabase project. | `SUPABASE_GET_PROJECT_LOGS` |
| Action | What it does | Slug |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------ |
| List organization members | Retrieves all members of a Supabase organization, identified by its unique slug, including their user ID, username, email, role, and MFA status. | `SUPABASE_LIST_ORGANIZATION_MEMBERS` |
| Action | What it does | Slug |
| ------------- | ------------------------------------------------------------------------------------------------------ | ------------------------ |
| Get migration | Retrieves a specific database migration entry from the migration history using its version identifier. | `SUPABASE_GET_MIGRATION` |
| Action | What it does | Slug |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
| Get organization | Fetches comprehensive details for a specific Supabase organization using its unique slug. | `SUPABASE_GET_ORGANIZATION` |
| List all organizations | Lists all organizations (ID and name only) associated with the Supabase account, excluding project details within these organizations. | `SUPABASE_LIST_ALL_ORGANIZATIONS` |
| Action | What it does | Slug |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
| Beta get project network bans | Retrieves the list of banned IPv4 addresses for a Supabase project using its unique project reference string. | `SUPABASE_BETA_GET_PROJECT_NETWORK_BANS` |
| Beta get project network restrictions | Retrieves the network restriction settings (IP allowlists) for a Supabase project. | `SUPABASE_BETA_GET_PROJECT_NETWORK_RESTRICTIONS` |
| Get project | Retrieves detailed information about a specific Supabase project by its unique reference ID. | `SUPABASE_GET_PROJECT` |
| Get project readonly mode status | Retrieves the read-only mode status for a specified Supabase project to check its operational state. | `SUPABASE_GET_PROJECT_READONLY_MODE_STATUS` |
| Get project upgrade eligibility | Checks a Supabase project's eligibility for an upgrade, verifying compatibility and identifying potential issues. | `SUPABASE_GET_PROJECT_UPGRADE_ELIGIBILITY` |
| Get project upgrade status | Retrieves the latest status of a Supabase project's database upgrade for monitoring purposes. | `SUPABASE_GET_PROJECT_UPGRADE_STATUS` |
| List all projects | Retrieves a list of all Supabase projects, including their ID, name, region, and status, for the authenticated user. | `SUPABASE_LIST_ALL_PROJECTS` |
| Action | What it does | Slug |
| ------------------- | ------------------------------------------------------ | ------------------------------ |
| Run read only query | \[Beta] Run a SQL query as supabase\_read\_only\_user. | `SUPABASE_RUN_READ_ONLY_QUERY` |
| Action | What it does | Slug |
| --------------------- | ---------------------------------------------------------------------- | -------------------------------- |
| Get available regions | Get the list of available regions for creating a new Supabase project. | `SUPABASE_GET_AVAILABLE_REGIONS` |
| Action | What it does | Slug |
| ----------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------- |
| Count action runs | Counts the number of action runs for a Supabase project using a HEAD request. | `SUPABASE_COUNT_ACTION_RUNS` |
| Get action run | Retrieves the status and details of a specific action run, including its steps, timestamps, and configuration. | `SUPABASE_GET_ACTION_RUN` |
| Action | What it does | Slug |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
| Get table schemas | Retrieves column details, types, and constraints for multiple database tables to help debug schema issues and write accurate SQL queries. | `SUPABASE_GET_TABLE_SCHEMAS` |
| Action | What it does | Slug |
| ------------ | -------------------------------------------------------------------- | ----------------------- |
| List secrets | Retrieves all secrets for a Supabase project using its reference ID. | `SUPABASE_LIST_SECRETS` |
| Action | What it does | Slug |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
| Gets project s service health status | Retrieves the current health status for a Supabase project, for specified services or all services if the 'services' list is omitted. | `SUPABASE_GETS_PROJECT_S_SERVICE_HEALTH_STATUS` |
| Action | What it does | Slug |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| Beta get project custom hostname config | Retrieves a Supabase project's custom hostname configuration, including its status, SSL certificate, and ownership verification, noting that availability may depend on the project's plan. | `SUPABASE_BETA_GET_PROJECT_CUSTOM_HOSTNAME_CONFIG` |
| Beta get project pgsodium config | Retrieves the PGSodium configuration, including the root encryption key, for an existing Supabase project identified by its ref. | `SUPABASE_BETA_GET_PROJECT_PGSODIUM_CONFIG` |
| Beta get project SSL enforcement config | Retrieves the SSL enforcement configuration for a specified Supabase project, indicating if SSL connections are mandated for its database. | `SUPABASE_BETA_GET_PROJECT_SSL_ENFORCEMENT_CONFIG` |
| Beta get vanity subdomain config | Fetches the current vanity subdomain configuration, including its status and custom domain name, for a Supabase project identified by its reference ID. | `SUPABASE_BETA_GET_VANITY_SUBDOMAIN_CONFIG` |
| Get auth config | | `SUPABASE_GET_AUTH_CONFIG` |
| Get database branch config | Retrieves the read-only configuration and status for a Supabase database branch, typically for monitoring or verifying its settings. | `SUPABASE_GET_DATABASE_BRANCH_CONFIG` |
| Get jit access config | \[Beta] Retrieves the project's just-in-time (JIT) access configuration, including user roles and their expiration settings. | `SUPABASE_GET_JIT_ACCESS_CONFIG` |
| Get project pgbouncer config | Retrieves the active PgBouncer configuration (PostgreSQL connection pooler) for a Supabase project, used for performance tuning, auditing, or getting the connection string. | `SUPABASE_GET_PROJECT_PGBOUNCER_CONFIG` |
| Get project postgres config | Retrieves the current read-only PostgreSQL database configuration for a specified Supabase project's ref, noting that some advanced or security-sensitive details might be omitted from the response. | `SUPABASE_GET_PROJECT_POSTGRES_CONFIG` |
| Get project postgrest config | Retrieves the PostgREST configuration for a specific Supabase project. | `SUPABASE_GET_PROJECT_POSTGREST_CONFIG` |
| Get project supavisor config | Retrieves the Supavisor (connection pooler) configuration for a specified Supabase project, identified by its reference ID. | `SUPABASE_GET_PROJECT_SUPAVISOR_CONFIG` |
| Get resumable upload base options | Handles OPTIONS request for TUS Resumable uploads to discover server capabilities. | `SUPABASE_GET_RESUMABLE_UPLOAD_BASE_OPTIONS` |
| Get resumable upload options | Handles OPTIONS request for TUS Resumable uploads to discover server capabilities. | `SUPABASE_GET_RESUMABLE_UPLOAD_OPTIONS` |
| Gets project s auth config | Retrieves the project's complete read-only authentication configuration, detailing all settings (e.g., providers, MFA, email/SMS, JWT, security policies) but excluding sensitive secrets. | `SUPABASE_GETS_PROJECT_S_AUTH_CONFIG` |
| Handle resumable upload sign options | Handles CORS preflight OPTIONS request for TUS resumable upload signing. | `SUPABASE_HANDLE_RESUMABLE_UPLOAD_SIGN_OPTIONS` |
| Handle resumable upload sign options with ID | Handles CORS preflight OPTIONS request for TUS resumable upload signing endpoints. | `SUPABASE_HANDLE_RESUMABLE_UPLOAD_SIGN_OPTIONS_WITH_ID` |
| Action | What it does | Slug |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
| Get SQL snippet | Retrieves a specific SQL snippet by its unique identifier. | `SUPABASE_GET_SQL_SNIPPET` |
| List SQL snippets | Retrieves a list of SQL snippets for the logged-in user, optionally filtered by a specific Supabase project if project\_ref is provided. | `SUPABASE_LIST_SQL_SNIPPETS` |
| Action | What it does | Slug |
| ------------ | --------------------------------------------------------------------------------------------------------------------- | ----------------------- |
| List buckets | Retrieves a list of all storage buckets for a Supabase project, without returning bucket contents or access policies. | `SUPABASE_LIST_BUCKETS` |
| Action | What it does | Slug |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------- |
| List tables | Lists all tables and views in specified database schemas, providing a quick overview of database structure to help identify available tables before fetching detailed schemas. | `SUPABASE_LIST_TABLES` |
| Select from table | Select rows from a Supabase/PostgREST table. | `SUPABASE_SELECT_FROM_TABLE` |
| Action | What it does | Slug |
| ------------------------- | ---------------------------------------------------------------------------- | ------------------------------------ |
| Generate typescript types | Generates and retrieves TypeScript types from a Supabase project's database. | `SUPABASE_GENERATE_TYPESCRIPT_TYPES` |
| Action | What it does | Slug |
| --------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------- |
| Beta authorize user through OAuth | Generates a Supabase OAuth 2.0 authorization URL for user redirection. | `SUPABASE_BETA_AUTHORIZE_USER_THROUGH_OAUTH` |
| Action | What it does | Slug |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
| Get health | Check the health status of the Supabase API. | `SUPABASE_GET_HEALTH` |
| Get performance advisors | Retrieves project performance advisors for a Supabase project. | `SUPABASE_GET_PERFORMANCE_ADVISORS` |
| Get security advisors | Retrieves security advisor findings and recommendations for a Supabase project. | `SUPABASE_GET_SECURITY_ADVISORS` |
| Get SSO provider | Retrieves the configuration details for a specific Single Sign-On (SSO) provider (e.g., SAML, Google, GitHub, Azure AD), identified by its UUID, within a Supabase project. | `SUPABASE_GET_SSO_PROVIDER` |
| List SSO providers | Lists all configured Single Sign-On (SSO) providers for a Supabase project, requiring the project reference ID (ref) of an existing project. | `SUPABASE_LIST_SSO_PROVIDERS` |
Agents can use 114 of the 128 Supabase actions at this level: everything in **Read-only**, plus:
* Update settings
* Create, update, and manage branches
* Create, update, and run functions
* Create and update keys
* Create and update migrations
* Create and update projects
* Update backups
* Test domains
* Create integrations
* Create organizations
* Create roles and permissions
* Create secrets
The 49 actions that this level adds to **Read-only**:
| Action | What it does | Slug |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| Restore pitr backup | Restores a Supabase project's database to a specific Unix timestamp using Point-in-Time Recovery (PITR), overwriting the current state. | `SUPABASE_RESTORE_PITR_BACKUP` |
| Action | What it does | Slug |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
| Create database branch | Creates a new, isolated database branch from an existing Supabase project (identified by ref), useful for setting up separate environments like development or testing, which can optionally be linked to a Git branch. | `SUPABASE_CREATE_DATABASE_BRANCH` |
| Merge branch | | `SUPABASE_MERGE_BRANCH` |
| Push branch | Pushes a database branch, applying migrations and changes to the specified branch. | `SUPABASE_PUSH_BRANCH` |
| Reset database branch | Resets an existing Supabase database branch, identified by branch\_id, to its initial clean state, irreversibly deleting all its current data and schema changes. | `SUPABASE_RESET_DATABASE_BRANCH` |
| Update branch | | `SUPABASE_UPDATE_BRANCH` |
| Action | What it does | Slug |
| ------------------------ | ----------------------------------------------------- | ----------------------------------- |
| Update database password | Updates the database password for a Supabase project. | `SUPABASE_UPDATE_DATABASE_PASSWORD` |
| Action | What it does | Slug |
| -------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------- |
| Verify custom hostname DNS | Re-verifies DNS and SSL configurations for an existing custom hostname associated with a Supabase project. | `SUPABASE_VERIFY_CUSTOM_HOSTNAME_DNS` |
| Action | What it does | Slug |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
| Create function | Creates a new serverless Edge Function for a Supabase project (identified by ref), requiring valid JavaScript/TypeScript in body and a project-unique slug identifier. | `SUPABASE_CREATE_FUNCTION` |
| Deploy function | Deploys Edge Functions to a Supabase project using multipart upload. | `SUPABASE_DEPLOY_FUNCTION` |
| Invoke edge function | Invoke a deployed Supabase Edge Function over HTTPS. | `SUPABASE_INVOKE_EDGE_FUNCTION` |
| Update a function | Updates an existing Supabase Edge Function's properties (like name, slug, source code, JWT settings, import map) identified by project ref and function\_slug, supporting plain text code or ESZIP for the body. | `SUPABASE_UPDATE_A_FUNCTION` |
| Update functions | Bulk update Edge Functions in a Supabase project. | `SUPABASE_UPDATE_FUNCTIONS` |
| Action | What it does | Slug |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| Create third party auth integration | Add a new third-party authentication method (OIDC or JWKS) to a Supabase project for integrating external identity providers (e.g., for SSO). | `SUPABASE_CREATE_THIRD_PARTY_AUTH_INTEGRATION` |
| Action | What it does | Slug |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| Alpha create API key | Creates a 'publishable' or 'secret' API key for an existing Supabase project, optionally with a description. | `SUPABASE_ALPHA_CREATE_API_KEY` |
| Alpha update API key | Updates an existing Supabase project API key's description and/or secret\_jwt\_template (which defines its role). | `SUPABASE_ALPHA_UPDATE_API_KEY` |
| Create project signing key | Create a new signing key for JWT authentication in a Supabase project. | `SUPABASE_CREATE_PROJECT_SIGNING_KEY` |
| Update project legacy API keys | Disable or re-enable JWT-based legacy API keys (anon, service\_role) for a Supabase project. | `SUPABASE_UPDATE_PROJECT_LEGACY_API_KEYS` |
| Action | What it does | Slug |
| ----------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------- |
| Apply a migration | Apply database migrations to a Supabase project. | `SUPABASE_APPLY_A_MIGRATION` |
| Patch migration | \[Beta] Patches an existing entry in the project's migration history, updating the name or rollback script. | `SUPABASE_PATCH_MIGRATION` |
| Upsert migration | Upsert a database migration without applying it. | `SUPABASE_UPSERT_MIGRATION` |
| Action | What it does | Slug |
| ------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
| Create organization | Creates a new Supabase organization, which serves as a top-level container for projects, billing, and team access. | `SUPABASE_CREATE_ORGANIZATION` |
| Action | What it does | Slug |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
| Beta update project network restrictions | Updates and applies network access restrictions (IPv4/IPv6 CIDR lists) for a Supabase project, which may terminate existing connections not matching the new rules. | `SUPABASE_BETA_UPDATE_PROJECT_NETWORK_RESTRICTIONS` |
| Create a project | Creates a new Supabase project, requiring a unique name (no dots) within the organization. | `SUPABASE_CREATE_A_PROJECT` |
| Disable project readonly | Temporarily disables a Supabase project's read-only mode for 15 minutes to allow write operations (e.g., for maintenance or critical updates), after which it automatically reverts to read-only. | `SUPABASE_DISABLE_PROJECT_READONLY` |
| Update project | Updates a Supabase project's configuration (currently supports updating the project name). | `SUPABASE_UPDATE_PROJECT` |
| Update project custom hostname | Updates the custom hostname for a Supabase project, requiring subsequent DNS changes to a user-controlled domain for SSL certificate issuance and domain ownership. | `SUPABASE_UPDATE_PROJECT_CUSTOM_HOSTNAME` |
| Action | What it does | Slug |
| ------------------ | ---------------------------------------------------------- | ----------------------------- |
| Beta run SQL query | Executes a given SQL query against the project's database. | `SUPABASE_BETA_RUN_SQL_QUERY` |
| Action | What it does | Slug |
| ----------------- | ---------------------------------------------------------------------------------- | ---------------------------- |
| Create login role | Creates a temporary CLI login role for database access with specified permissions. | `SUPABASE_CREATE_LOGIN_ROLE` |
| Action | What it does | Slug |
| -------------------- | ------------------------------------------- | ------------------------------- |
| Create bulk secrets | Bulk create secrets for a Supabase project. | `SUPABASE_CREATE_BULK_SECRETS` |
| List project secrets | | `SUPABASE_LIST_PROJECT_SECRETS` |
| Action | What it does | Slug |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| Update database branch config | Updates the configuration of a Supabase database branch, allowing modification of its name, associated Git branch, reset-on-push behavior, persistence, and status. | `SUPABASE_UPDATE_DATABASE_BRANCH_CONFIG` |
| Update jit access config | \[Beta] Update a Supabase project's just-in-time (JIT) access configuration. | `SUPABASE_UPDATE_JIT_ACCESS_CONFIG` |
| Update pgsodium config | Critically updates or initializes a Supabase project's pgsodium root encryption key for security setup or key rotation, requiring secure backup of the new key to prevent irreversible data loss. | `SUPABASE_UPDATE_PGSODIUM_CONFIG` |
| Update project auth config | Update Supabase project Auth configuration via the Management API. | `SUPABASE_UPDATE_PROJECT_AUTH_CONFIG` |
| Update project postgres config | Updates specified PostgreSQL configuration parameters for an existing Supabase project (ref) to optimize database performance. | `SUPABASE_UPDATE_PROJECT_POSTGRES_CONFIG` |
| Update project postgrest config | Updates PostgREST configuration settings (e.g., max\_rows, db\_pool, db\_schema, db\_extra\_search\_path) for a Supabase project to fine-tune API performance, data exposure, and database resource usage. | `SUPABASE_UPDATE_PROJECT_POSTGREST_CONFIG` |
| Update project supavisor config | Updates the Supavisor (database pooler) configuration, such as default\_pool\_size, for an existing Supabase project identified by ref. | `SUPABASE_UPDATE_PROJECT_SUPAVISOR_CONFIG` |
| Update SSL enforcement config | Updates the SSL enforcement configuration (enable/disable) for a specified Supabase project's database. | `SUPABASE_UPDATE_SSL_ENFORCEMENT_CONFIG` |
| Action | What it does | Slug |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
| Exchange OAuth token | (Beta) Implements the OAuth 2.0 token endpoint to exchange an authorization code or refresh token for access/refresh tokens, based on grant\_type. | `SUPABASE_EXCHANGE_OAUTH_TOKEN` |
| Action | What it does | Slug |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------ |
| Beta upgrade project postgres version | Initiates an asynchronous upgrade of a Supabase project's PostgreSQL database to a specified target\_version from a selected release\_channel, returning a tracking\_id to monitor status. | `SUPABASE_BETA_UPGRADE_PROJECT_POSTGRES_VERSION` |
| Action | What it does | Slug |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
| Beta enable database webhooks | Enables database webhooks for the Supabase project ref, triggering real-time notifications for INSERT, UPDATE, or DELETE events. | `SUPABASE_BETA_ENABLE_DATABASE_WEBHOOKS` |
| Action | What it does | Slug |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| Beta activate custom hostname | Activates a previously configured custom hostname for a Supabase project, assuming DNS settings are verified externally. | `SUPABASE_BETA_ACTIVATE_CUSTOM_HOSTNAME` |
| Beta activate vanity subdomain | Activates a vanity subdomain for the specified Supabase project (e.g., 'my-brand.supabase.co'). | `SUPABASE_BETA_ACTIVATE_VANITY_SUBDOMAIN` |
| Beta create read replica | Provisions a read-only replica for a Supabase project in a specified, Supabase-supported AWS region to enhance read performance and reduce latency. | `SUPABASE_BETA_CREATE_READ_REPLICA` |
| Create SSO provider | Creates a new SAML 2.0 Single Sign-On (SSO) provider for a Supabase project, requiring either metadata\_xml or metadata\_url for SAML IdP configuration. | `SUPABASE_CREATE_SSO_PROVIDER` |
| Disable preview branching | Disables the preview branching feature for an existing Supabase project, identified by its unique reference ID (ref). | `SUPABASE_DISABLE_PREVIEW_BRANCHING` |
| Patch network restrictions | Updates project's network restrictions by incrementally adding or removing IPv4/IPv6 CIDR blocks. | `SUPABASE_PATCH_NETWORK_RESTRICTIONS` |
| Update SSO provider | Updates an existing SSO provider's SAML metadata, associated email domains, or attribute mappings for a Supabase project, identified by ref and provider\_id. | `SUPABASE_UPDATE_SSO_PROVIDER` |
## Connect Supabase
Before you start:
* You need a Supabase account that you can sign in to.
* Your Squad subscription must be active. Squad does not connect apps while the subscription is not active.
Open **Settings** > **Integrations**.
On the **Connected apps** tab, click **+ Add integration**.
Find **Supabase** in the catalog and click it. You can type the name in **Search the catalog…**.
Under **Default scope**, choose an access level. This level applies to every agent.
Click **Connect Supabase**. The Supabase sign-in page opens in a new tab.
Sign in to Supabase and approve the request.
Check that it works: Supabase shows under **YOUR CONNECTIONS**, with a row for the account and its access level.
## Change the access level
1. Under **YOUR CONNECTIONS**, find the Supabase account.
2. Open the account menu (⋯) and click **Manage scope**.
3. Under **Default scope**, choose the new level.
4. Click **Save access**.
The change does not need a new sign-in. Agents get the new level from their next call.
## Set access for one agent
Every agent uses the account's level unless you set something else for it. You can narrow one agent to a lower level, or block it.
1. Under **YOUR CONNECTIONS**, open the account menu (⋯) on the Supabase account.
2. Click **Manage scope**.
3. Under **Per-agent access**, find the agent.
4. Choose the **Default** option to follow the account's level, choose a lower level, or choose **No access**.
5. Click **Save access**.
An agent never gets more than the account's level, even if you choose a higher level for it. Changes apply from the agent's next call. An agent with **No access** does not see the account.
## Use more than one Supabase account
Click **+ Account** on the Supabase card to connect another account. Agents use the primary account unless they are asked to use a specific one.
* After you click **+ Account**, follow the connect steps above.
* Each account has its own access level.
* The first account you connect becomes the primary account. It shows **★ PRIMARY**.
* To change the primary account, open the account menu (⋯) and click **Make primary**.
* To tell accounts apart, open the account menu (⋯) and click **Rename**.
## Reconnect or disconnect
Reconnect when the connection has expired, or when you need to change what the account can reach on the Supabase side:
1. Open the account menu (⋯) and click **Reconnect**.
2. Click **Reauthorize on Supabase**.
3. Sign in to Supabase and approve the request.
Reconnect signs in to the same account again. It does not add a second connection.
Open the account menu (⋯) on the Supabase account and click **Disconnect**. Agents lose access to that account at once.
**Disconnect** acts at once, with no confirmation step. If it was the primary account, another connected Supabase account becomes primary.
## Costs
Supabase actions do not use Squad credits. Connected apps never use credits. For what does use credits, see [What Squad costs](/docs/costs).
## Troubleshooting
An agent reports that an action is not allowed on this account.
* Cause: the action is outside the account's access level, or outside the level you set for that agent.
* Fix: choose a higher level in **Manage scope**, or change the agent's row under **Per-agent access**.
An agent says it has no access to Supabase, or it does not see the account.
* Cause: the agent is set to **No access** under **Per-agent access**, or the account is not connected.
* Fix: open **Manage scope** and change the agent's row. If the account is missing, connect it again.
Connecting or saving fails with "Your subscription isn't active."
* Cause: your Squad subscription is not active.
* Fix: resubscribe. See [Manage your subscription](/docs/billing).
An agent says the Supabase connection has expired.
* Cause: the sign-in for that account is no longer valid.
* Fix: use **Reconnect** on the account.
## Common questions
Each Supabase account has an access level: **Read-only** and **Read + write**. Squad refuses any agent action outside that level. You can also narrow or block single agents under **Per-agent access**.
Click **+ Account** on the Supabase card to connect another account. Agents use the primary account unless they are asked to use a specific one.
Open the account menu (⋯) on the Supabase account and click **Disconnect**. Agents lose access to that account at once.
## Related pages
Use this when an action you need is not in this app.