Until now, a personal access token could do anything your account could do, across every organization and project. Starting August 10, 2026, we're rolling out scoped PATs to a small group of users, so you can limit a token to the resources and permissions it actually needs. If you don't see the new form yet, you will as the rollout expands.
When you generate a token from your account's access tokens page, you can now choose:
Before the token is created, a review step shows the access you're granting and an overall risk level. A token's access can't be changed after creation. To change it, delete the token and create a new one.
Scoped tokens don't work with the Supabase MCP server yet, though that support is on the way. If you need MCP server access today, create a legacy (account-level) token.
You can still create a full account-level PAT via "Create legacy token", but we recommend against it. A token limited to the projects and permissions it actually needs is a much smaller blast radius if it ever leaks.
Every existing token keeps working until it expires or you delete it. Nothing is being revoked and there's nothing you need to do right now, though once scoped PATs reach you, it's worth swapping your old tokens for scoped ones.
We'd love feedback from alpha users, especially on permission scopes you're missing or workflows the new form doesn't cover. Drop a comment below.
The thread announces the alpha rollout of scoped personal access tokens (PATs) starting August 10, 2026. These tokens allow users to limit access to specific resources and permissions, enhancing security. The rollout includes features like resource access, permission scopes, and expiry settings. There is a known limitation with Supabase MCP server compatibility, which will be addressed in the future. Feedback from alpha users is encouraged.