Supabase Platform Access Control: Project Permissions Breaking Changes on October 15, 2024

These breaking changes are rolling out on October 15, 2024 and affects only organizations on the Enterprise plan that have implemented project permissions with members assigned the Developer role.

Supabase launched new granular access control for Enterprise organizations so that its members are given access to specific projects instead of the entire organization. You can check out our Launch Week 12 announcement to learn more.

We recently re-evaluated the access that the Developer role has and decided to implement changes to restrict them on a couple of resources to improve your project's security.

On October 15, 2024, we will turn off certain access that the Developer role currently has to your project's resources. The following table is to illustrate all of the breaking changes that will be going into effect:

Resource	Action	Developer	Read-Only
API Configuration
JWT Secret	Generate new	✅ → ❌	❌¹
API Settings	Update	✅ → ❌	❌¹
Auth Configuration
Auth Settings	Update	✅ → ❌	❌¹
Advanced Settings	Update	✅ → ❌	❌¹
Storage Configuration
Upload Limit	Update	✅ → ❌	❌¹
S3 access keys	Create	✅ → ❌	❌¹
	Delete	✅ → ❌	❌¹
Edge Functions Configuration
Secrets	Create	✅ → ❌	❌¹
	Delete	✅ → ❌	❌¹
Authentication
Providers	Update	✅ → ❌	❌¹
Rate Limits	Update	✅ → ❌	❌¹
Email Templates	Update	✅ → ❌	❌¹
URL Configuration	Update	✅ → ❌	❌¹
Logs & Analytics
Events Collections	Create	✅ → ❌	❌¹
	Update	✅ → ❌	❌¹
	Delete	✅ → ❌	❌¹
Warehouse Access Tokens	Create	✅ → ❌	❌¹
	Revoke	✅ → ❌	❌¹

You can learn more about our Platform Access Control here: https://supabase.com/docs/guides/platform/access-control.

If you have any questions or concerns please contact support.

Role's permission to the resource and action will remain the same. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸

Footnotes#

Build in a weekend, scale to millions