# Supabase

Supabase is an open-source backend-as-a-service providing a Postgres database, authentication, storage, and real-time subscription APIs for building modern applications

- **Category:** developer tools
- **Auth:** OAUTH2, API_KEY
- **Tools:** 84
- **Triggers:** 0
- **Slug:** `SUPABASE`
- **Version:** 20260217_00

## Tools

### Create project api key

**Slug:** `SUPABASE_ALPHA_CREATES_A_NEW_API_KEY_FOR_THE_PROJECT`

Creates a 'publishable' or 'secret' API key for an existing Supabase project, optionally with a description; 'secret' keys can have customized JWT templates.

### Delete an API key from the project

**Slug:** `SUPABASE_ALPHA_DELETES_AN_API_KEY_FOR_THE_PROJECT`

Permanently deletes a specific API key (identified by `id`) from a Supabase project (identified by `ref`), revoking its access.

### Get a third-party integration

**Slug:** `SUPABASE_ALPHA_GET_A_THIRD_PARTY_INTEGRATION`

Retrieves the detailed configuration for a specific third-party authentication (TPA) provider, identified by `tpa_id`, within an existing Supabase project specified by `ref`.

### List third-party auth integrations for project

**Slug:** `SUPABASE_ALPHA_LISTS_ALL_THIRD_PARTY_AUTH_INTEGRATIONS`

Lists all configured third-party authentication provider integrations for an existing Supabase project (using its `ref`), suitable for read-only auditing or verifying current authentication settings.

### Delete third party auth config

**Slug:** `SUPABASE_ALPHA_REMOVES_A_THIRD_PARTY_AUTH_INTEGRATION`

Removes a third-party authentication provider (e.g., Google, GitHub) from a Supabase project's configuration; this immediately prevents users from logging in via that method.

### Update an API key for the project

**Slug:** `SUPABASE_ALPHA_UPDATES_AN_API_KEY_FOR_THE_PROJECT`

Updates an existing Supabase project API key's `description` and/or `secret_jwt_template` (which defines its `role`); does not regenerate the key string.

### Beta activate custom hostname for project

**Slug:** `SUPABASE_BETA_ACTIVATES_A_CUSTOM_HOSTNAME_FOR_A_PROJECT`

Activates a previously configured custom hostname for a Supabase project, assuming DNS settings are verified externally.

### Activate vanity subdomain for project

**Slug:** `SUPABASE_BETA_ACTIVATES_A_VANITY_SUBDOMAIN_FOR_A_PROJECT`

Activates a vanity subdomain for the specified Supabase project (e.g., 'my-brand.supabase.co'). Important notes: - Vanity subdomains require a paid plan (Pro/Team/Enterprise) - Usage of vanity subdomains and custom domains is mutually exclusive - After activation, your project's auth services will no longer work on the original {project-ref}.supabase.co hostname - Schedule a downtime window to update client code and OAuth providers before activating

### Authorize user through OAuth

**Slug:** `SUPABASE_BETA_AUTHORIZE_USER_THROUGH_OAUTH`

Generates a Supabase OAuth 2.0 authorization URL for user redirection. IMPORTANT: This action requires a pre-registered OAuth client_id and a redirect_uri that matches one of the pre-registered URIs for that OAuth application. Without a valid registered OAuth application, this endpoint will return a 400 error. To use this action: 1. Register an OAuth application in the Supabase dashboard 2. Use the client_id from the registered application 3. Ensure redirect_uri matches one of the registered callback URLs

### Check vanity subdomain availability

**Slug:** `SUPABASE_BETA_CHECKS_VANITY_SUBDOMAIN_AVAILABILITY`

Checks if a specific vanity subdomain is available for a Supabase project; this action does not reserve or assign the subdomain.

### Enable project database webhooks

**Slug:** `SUPABASE_BETA_ENABLES_DATABASE_WEBHOOKS_ON_THE_PROJECT`

Enables database webhooks for the Supabase project `ref`, triggering real-time notifications for INSERT, UPDATE, or DELETE events.

### Get project SSL enforcement configuration

**Slug:** `SUPABASE_BETA_GET_PROJECT_S_SSL_ENFORCEMENT_CONFIGURATION`

Retrieves the SSL enforcement configuration for a specified Supabase project, indicating if SSL connections are mandated for its database.

### Get current vanity subdomain config

**Slug:** `SUPABASE_BETA_GETS_CURRENT_VANITY_SUBDOMAIN_CONFIG`

Fetches the current vanity subdomain configuration, including its status and custom domain name, for a Supabase project identified by its reference ID.

### Beta get project's custom hostname config

**Slug:** `SUPABASE_BETA_GETS_PROJECT_S_CUSTOM_HOSTNAME_CONFIG`

Retrieves a Supabase project's custom hostname configuration, including its status, SSL certificate, and ownership verification, noting that availability may depend on the project's plan.

### Retrieve network bans for project

**Slug:** `SUPABASE_BETA_GETS_PROJECT_S_NETWORK_BANS`

Retrieves the list of banned IPv4 addresses for a Supabase project using its unique project reference string; this is a read-only operation.

### Get project network restrictions

**Slug:** `SUPABASE_BETA_GETS_PROJECT_S_NETWORK_RESTRICTIONS`

Retrieves the network restriction settings (IP allowlists) for a Supabase project. Use this action to: - Check which IPv4/IPv6 CIDR blocks are allowed to connect to the project's database - Verify if network restrictions are enabled (entitlement: "allowed") or disabled ("disallowed") - Audit current network security configuration - Check if network restrictions have been modified (old_config present) Note: Default values 0.0.0.0/0 (IPv4) and ::/0 (IPv6) mean all IPs are allowed. Network restrictions require a Pro, Team, or Enterprise plan.

### Get project pgsodium config

**Slug:** `SUPABASE_BETA_GETS_PROJECT_S_PGSODIUM_CONFIG`

Retrieves the PGSodium configuration, including the root encryption key, for an existing Supabase project identified by its `ref`.

### Remove read replica

**Slug:** `SUPABASE_BETA_REMOVE_A_READ_REPLICA`

Remove a read replica from a Supabase project (Pro plan or higher required). This beta endpoint initiates the removal of a specified read replica database. The operation is irreversible. Before removal, ensure all application traffic is redirected from the replica to the primary database. Requirements: - Project must be on Pro plan or higher - Bearer token with infra_read_replicas_write permission (FGA) - Valid read replica database identifier Note: Returns 201 on success with an empty response body.

### Remove project network bans

**Slug:** `SUPABASE_BETA_REMOVE_NETWORK_BANS`

Removes specified IPv4 addresses from a Supabase project's network ban list, granting immediate access; IPs not currently banned are ignored.

### Execute project database query

**Slug:** `SUPABASE_BETA_RUN_SQL_QUERY`

Executes a given SQL query against the project's database; use for advanced data operations or when standard API endpoints are insufficient, ensuring queries are valid PostgreSQL and sanitized. Use the get_table_schemas or generate_type_script_types tool to retrieve the table schema, then base your query on it.

### Setup read replica for project

**Slug:** `SUPABASE_BETA_SET_UP_A_READ_REPLICA`

Provisions a read-only replica for a Supabase project in a specified, Supabase-supported AWS region to enhance read performance and reduce latency.

### Beta update project network restrictions

**Slug:** `SUPABASE_BETA_UPDATES_PROJECT_S_NETWORK_RESTRICTIONS`

Updates and applies network access restrictions (IPv4/IPv6 CIDR lists) for a Supabase project, which may terminate existing connections not matching the new rules.

### Upgrade the project's PostgreSQL version

**Slug:** `SUPABASE_BETA_UPGRADES_THE_PROJECT_S_POSTGRES_VERSION`

Initiates an asynchronous upgrade of a Supabase project's PostgreSQL database to a specified `target_version` from a selected `release_channel`, returning a `tracking_id` to monitor status; the `target_version` must be available in the chosen channel.

### Update pgsodium root key

**Slug:** `SUPABASE_CONFIG_PGSODIUM_UPDATE_WITH_ROOT_KEY_WARNING`

Critically updates or initializes a Supabase project's pgsodium root encryption key for security setup or key rotation, requiring secure backup of the new key to prevent irreversible data loss.

### Create a database branch

**Slug:** `SUPABASE_CREATE_A_DATABASE_BRANCH`

Creates a new, isolated database branch from an existing Supabase project (identified by `ref`), useful for setting up separate environments like development or testing, which can optionally be linked to a Git branch.

### Create a function

**Slug:** `SUPABASE_CREATE_A_FUNCTION`

Creates a new serverless Edge Function for a Supabase project (identified by `ref`), requiring valid JavaScript/TypeScript in `body` and a project-unique `slug` identifier.

### Create an organization

**Slug:** `SUPABASE_CREATE_AN_ORGANIZATION`

Creates a new Supabase organization, which serves as a top-level container for projects, billing, and team access.

### Create new project

**Slug:** `SUPABASE_CREATE_A_PROJECT`

Creates a new Supabase project, requiring a unique name (no dots) within the organization; project creation is asynchronous.

### Create SSO provider configuration

**Slug:** `SUPABASE_CREATES_A_NEW_SSO_PROVIDER`

Creates a new SAML 2.0 Single Sign-On (SSO) provider for a Supabase project, requiring either `metadata_xml` or `metadata_url` for SAML IdP configuration.

### Create a new third-party auth integration

**Slug:** `SUPABASE_CREATES_A_NEW_THIRD_PARTY_AUTH_INTEGRATION`

Call this to add a new third-party authentication method (OIDC or JWKS) to a Supabase project for integrating external identity providers (e.g., for SSO); the API may also support `custom_jwks` if sent directly.

### Reverify custom hostname

**Slug:** `SUPABASE_CUSTOM_HOSTNAME_DNS_VERIFICATION`

Re-verifies DNS and SSL configurations for an existing custom hostname associated with a Supabase project.

### Delete branch by id

**Slug:** `SUPABASE_DELETE_A_DATABASE_BRANCH`

Permanently and irreversibly deletes a specific, non-default database branch by its `branch_id`, without affecting other branches.

### Delete an edge function by slug

**Slug:** `SUPABASE_DELETE_A_FUNCTION`

Permanently deletes a specific Edge Function (by `function_slug`) from a Supabase project (by `ref`); this action is irreversible and requires prior existence of both project and function.

### Delete custom hostname config

**Slug:** `SUPABASE_DELETE_CUSTOM_HOSTNAME_CONFIG`

Deletes an active custom hostname configuration for the project identified by `ref`, reverting to the default Supabase-provided hostname; this action immediately makes the project inaccessible via the custom domain and requires subsequent updates to client, OAuth, and DNS settings.

### Delete vanity subdomain for project

**Slug:** `SUPABASE_DELETE_PROJECT_VANITY_SUBDOMAIN`

Permanently and irreversibly deletes an active vanity subdomain configuration for the specified Supabase project, reverting it to its default Supabase URL.

### Delete project by ref

**Slug:** `SUPABASE_DELETES_THE_GIVEN_PROJECT`

Permanently and irreversibly deletes a Supabase project, identified by its unique `ref` ID, resulting in complete data loss.

### Deploy function

**Slug:** `SUPABASE_DEPLOY_FUNCTION`

Deploys Edge Functions to a Supabase project using multipart upload.

### Disable project readonly mode

**Slug:** `SUPABASE_DISABLE_PROJECT_READONLY`

Temporarily disables a Supabase project's read-only mode for 15 minutes to allow write operations (e.g., for maintenance or critical updates), after which it automatically reverts to read-only.

### Disable preview branching

**Slug:** `SUPABASE_DISABLES_PREVIEW_BRANCHING`

Disables the preview branching feature for an existing Supabase project, identified by its unique reference ID (`ref`). Note: Preview branching must be enabled on the project for this operation to succeed. If the project does not have preview branching enabled, a 422 error will be returned.

### Exchange auth code for access and refresh token

**Slug:** `SUPABASE_EXCHANGE_O_AUTH_TOKEN`

(Beta) Implements the OAuth 2.0 token endpoint to exchange an authorization code or refresh token for access/refresh tokens, based on `grant_type`. This is a standard OAuth 2.0 token endpoint that uses application/x-www-form-urlencoded content type as per OAuth 2.0 specification. Requires a valid registered OAuth application client_id and client_secret. For authorization_code grant type: - Requires valid authorization code obtained from the OAuth authorization flow - Optionally requires code_verifier if PKCE was used during authorization For refresh_token grant type: - Requires valid refresh_token from a previous token exchange

### Generate TypeScript types

**Slug:** `SUPABASE_GENERATE_TYPE_SCRIPT_TYPES`

Generates and retrieves TypeScript types from a Supabase project's database; any schemas specified in `included_schemas` must exist in the project.

### Get database branch config

**Slug:** `SUPABASE_GET_DATABASE_BRANCH_CONFIG`

Retrieves the read-only configuration and status for a Supabase database branch, typically for monitoring or verifying its settings.

### Get project API keys

**Slug:** `SUPABASE_GET_PROJECT_API_KEYS`

Retrieves all API keys for an existing Supabase project, specified by its unique reference ID (`ref`); this is a read-only operation.

### Get project PgBouncer config

**Slug:** `SUPABASE_GET_PROJECT_S_PGBOUNCER_CONFIG`

Retrieves the active PgBouncer configuration (PostgreSQL connection pooler) for a Supabase project, used for performance tuning, auditing, or getting the connection string.

### Get Project Upgrade Eligibility

**Slug:** `SUPABASE_GET_PROJECT_UPGRADE_ELIGIBILITY`

Checks a Supabase project's eligibility for an upgrade, verifying compatibility and identifying potential issues; this action does not perform the actual upgrade.

### Get project upgrade status

**Slug:** `SUPABASE_GET_PROJECT_UPGRADE_STATUS`

Retrieves the latest status of a Supabase project's database upgrade for monitoring purposes; does not initiate or modify upgrades.

### Get a specific SQL snippet

**Slug:** `SUPABASE_GETS_A_SPECIFIC_SQL_SNIPPET`

Retrieves a specific SQL snippet by its unique identifier.

### Get a SSO provider by its UUID

**Slug:** `SUPABASE_GETS_A_SSO_PROVIDER_BY_ITS_UUID`

Retrieves the configuration details for a specific Single Sign-On (SSO) provider (e.g., SAML, Google, GitHub, Azure AD), identified by its UUID, within a Supabase project.

### Get information about an organization

**Slug:** `SUPABASE_GETS_INFORMATION_ABOUT_THE_ORGANIZATION`

Fetches comprehensive details for a specific Supabase organization using its unique slug.

### Get project's auth config

**Slug:** `SUPABASE_GETS_PROJECT_S_AUTH_CONFIG`

Retrieves the project's complete read-only authentication configuration, detailing all settings (e.g., providers, MFA, email/SMS, JWT, security policies) but excluding sensitive secrets.

### Get project postgres config

**Slug:** `SUPABASE_GETS_PROJECT_S_POSTGRES_CONFIG`

Retrieves the current read-only PostgreSQL database configuration for a specified Supabase project's `ref`, noting that some advanced or security-sensitive details might be omitted from the response.

### Get project's PostgREST config

**Slug:** `SUPABASE_GETS_PROJECT_S_POSTGREST_CONFIG`

Retrieves the PostgREST configuration for a specific Supabase project.

### Get project's service health status

**Slug:** `SUPABASE_GETS_PROJECT_S_SERVICE_HEALTH_STATUS`

Retrieves the current health status for a Supabase project, for specified services or all services if the 'services' list is omitted.

### Get project Supavisor configuration

**Slug:** `SUPABASE_GETS_PROJECT_S_SUPAVISOR_CONFIG`

Retrieves the Supavisor (connection pooler) configuration for a specified Supabase project, identified by its reference ID.

### Get Table Schemas

**Slug:** `SUPABASE_GET_TABLE_SCHEMAS`

Retrieves column details, types, and constraints for multiple database tables to help debug schema issues and write accurate SQL queries. Use the SUPABASE_LIST_TABLES action first to discover available tables, the fetch their detailed schemas.

### Invoke Edge Function

**Slug:** `SUPABASE_INVOKE_EDGE_FUNCTION`

Tool to invoke a deployed Supabase Edge Function over HTTPS. Use for testing and debugging Edge Functions with configurable method, headers, body, and authentication.

### List all database branches

**Slug:** `SUPABASE_LIST_ALL_DATABASE_BRANCHES`

Lists all database branches for a specified Supabase project, used for isolated development and testing of schema changes; ensure the project reference ID is valid.

### List all functions

**Slug:** `SUPABASE_LIST_ALL_FUNCTIONS`

Lists metadata for all Edge Functions in a Supabase project (specified by 'ref'), excluding function code or logs; the project must exist.

### List all organizations

**Slug:** `SUPABASE_LIST_ALL_ORGANIZATIONS`

Lists all organizations (ID and name only) associated with the Supabase account, excluding project details within these organizations.

### List all projects

**Slug:** `SUPABASE_LIST_ALL_PROJECTS`

Retrieves a list of all Supabase projects, including their ID, name, region, and status, for the authenticated user. Authentication: - Requires a valid Bearer token in the Authorization header. - Token format: 'Bearer <access_token>' where access_token is either: - A Personal Access Token (PAT) generated from https://supabase.com/dashboard/account/tokens - An OAuth2 access token with the 'Projects.Read' scope Required Scope: - Projects.Read: Allows retrieval of project metadata. Returns: List of Project objects containing id, name, organization_id, region, status, database info, and created_at.

### List all secrets

**Slug:** `SUPABASE_LIST_ALL_SECRETS`

Retrieves all secrets for a Supabase project using its reference ID; secret values in the response may be masked.

### List members of an organization

**Slug:** `SUPABASE_LIST_MEMBERS_OF_AN_ORGANIZATION`

Retrieves all members of a Supabase organization, identified by its unique slug, including their user ID, username, email, role, and MFA status.

### List project database backups

**Slug:** `SUPABASE_LISTS_ALL_BACKUPS`

Lists all database backups for a Supabase project, providing details on existing backups but not creating new ones or performing restores; availability may depend on plan and configuration.

### List all buckets

**Slug:** `SUPABASE_LISTS_ALL_BUCKETS`

Retrieves a list of all storage buckets for a Supabase project, without returning bucket contents or access policies.

### List all SSO providers

**Slug:** `SUPABASE_LISTS_ALL_SSO_PROVIDERS`

Lists all configured Single Sign-On (SSO) providers for a Supabase project, requiring the project reference ID (`ref`) of an existing project.

### List SQL snippets for the logged in user

**Slug:** `SUPABASE_LISTS_SQL_SNIPPETS_FOR_THE_LOGGED_IN_USER`

Retrieves a list of SQL snippets for the logged-in user, optionally filtered by a specific Supabase project if `project_ref` is provided.

### List Database Tables

**Slug:** `SUPABASE_LIST_TABLES`

Lists all tables and views in specified database schemas, providing a quick overview of database structure to help identify available tables before fetching detailed schemas.

### Remove an SSO provider

**Slug:** `SUPABASE_REMOVES_A_SSO_PROVIDER_BY_ITS_UUID`

Deletes a specific SSO provider by its ID (`provider_id`) from a Supabase project (`ref`), which disables it and returns its details; ensure this action will not inadvertently lock out users.

### Reset a database branch

**Slug:** `SUPABASE_RESETS_A_DATABASE_BRANCH`

Resets an existing Supabase database branch, identified by `branch_id`, to its initial clean state, irreversibly deleting all its current data and schema changes.

### Restore database PITR backup

**Slug:** `SUPABASE_RESTORES_A_PITR_BACKUP_FOR_A_DATABASE`

Restores a Supabase project's database to a specific Unix timestamp using Point-in-Time Recovery (PITR), overwriting the current state; requires a paid plan with PITR and physical backups enabled.

### OPTIONS for resumable upload sign

**Slug:** `SUPABASE_RESUMABLE_UPLOAD_SIGN_OPTIONS_WITH_ID`

Handles CORS preflight OPTIONS request for TUS resumable upload signing endpoints. Use when preparing cross-origin resumable upload requests to verify allowed methods and headers.

### Retrieve a function

**Slug:** `SUPABASE_RETRIEVE_A_FUNCTION`

Retrieves detailed information, metadata, configuration, and status for a specific Edge Function using its project reference ID and function slug.

### Retrieve a function body

**Slug:** `SUPABASE_RETRIEVE_A_FUNCTION_BODY`

Retrieves the source code (body) for a specified serverless Edge Function using its project reference and function slug; this is a read-only operation that does not execute the function or return runtime logs.

### Get project's read-only mode status

**Slug:** `SUPABASE_RETURNS_PROJECT_S_READONLY_MODE_STATUS`

Retrieves the read-only mode status for a specified Supabase project to check its operational state; this action does not change the read-only state.

### Select From Table

**Slug:** `SUPABASE_SELECT_FROM_TABLE`

Tool to select rows from a Supabase/PostgREST table. Use for read-only queries with filtering, sorting, and pagination.

### Update a function

**Slug:** `SUPABASE_UPDATE_A_FUNCTION`

Updates an existing Supabase Edge Function's properties (like name, slug, source code, JWT settings, import map) identified by project `ref` and `function_slug`, supporting plain text code or ESZIP for the body. Use RETRIEVE_A_FUNCTION_BODY action first to get the current source code, as this action requires sending the complete function code, not just the changes.

### Update database branch config

**Slug:** `SUPABASE_UPDATE_DATABASE_BRANCH_CONFIG`

Updates the configuration of a Supabase database branch, allowing modification of its name, associated Git branch, reset-on-push behavior, persistence, and status. Note: Database branching requires a paid Supabase plan (Pro or higher). This action requires a valid branch_id which must be exactly 20 lowercase alphabetic characters. Authentication: - Requires a valid Bearer token in the Authorization header. - Token format: 'Bearer <access_token>' Required Scope: - Environment:Write

### Update project's auth config

**Slug:** `SUPABASE_UPDATE_PROJECT_AUTH_CONFIG`

Update Supabase project Auth configuration via the Management API. Use to fix misconfigured Auth redirects, SMTP settings, or other auth parameters. Only provided fields are updated; others remain unchanged. Before updating, confirm the Auth service status is ACTIVE_HEALTHY by checking project health.

### Update project's custom hostname configuration

**Slug:** `SUPABASE_UPDATE_PROJECT_CUSTOM_HOSTNAME_ACTION`

Updates the custom hostname for a Supabase project, requiring subsequent DNS changes to a user-controlled domain for SSL certificate issuance and domain ownership.

### Update an SSO provider by its UUID

**Slug:** `SUPABASE_UPDATES_A_SSO_PROVIDER_BY_ITS_UUID`

Updates an existing SSO provider's SAML metadata, associated email domains, or attribute mappings for a Supabase project, identified by `ref` and `provider_id`.

### Update project's postgres config

**Slug:** `SUPABASE_UPDATES_PROJECT_S_POSTGRES_CONFIG`

Updates specified PostgreSQL configuration parameters for an existing Supabase project (`ref`) to optimize database performance; note that unspecified parameters remain unchanged, and caution is advised as incorrect settings can impact stability or require a restart.

### Update project's PostgREST config

**Slug:** `SUPABASE_UPDATES_PROJECT_S_POSTGREST_CONFIG`

Updates PostgREST configuration settings (e.g., `max_rows`, `db_pool`, `db_schema`, `db_extra_search_path`) for a Supabase project to fine-tune API performance, data exposure, and database resource usage.

### Update database pooler config

**Slug:** `SUPABASE_UPDATES_PROJECT_S_SUPAVISOR_CONFIG`

Updates the Supavisor (database pooler) configuration, such as `default_pool_size`, for an existing Supabase project identified by `ref`; the `pool_mode` parameter in the request is deprecated and ignored.

### Update SSL enforcement config

**Slug:** `SUPABASE_UPDATE_SSL_ENFORCEMENT_CONFIG`

Updates the SSL enforcement configuration (enable/disable) for a specified Supabase project's database.
