Map team members to Postgres roles

Let a team member connect to your project database as a Postgres role, using their own access token instead of a shared password. This follows security best practices, allowing each person to only access what they need for as long as they need it.

A role mapping authorizes a team member to assume one or more Postgres roles. It creates no new role or user in the database, and the assumed role's permissions apply. The role's own password keeps working, so long-lived service connections don't change. A team member who knows the role's password can connect with it after you remove their mapping. To end that access, change the role's password. For the postgres role, see Changing your project password.

Use this guide when:

• Your team shares the postgres password, and you want each person to connect with their own credentials.
• Someone needs database access that ends on a date you set.
• You want to remove one person's access without changing a password everyone else uses.

For how temporary access works and how to connect with it, see Temporary access.

Prerequisites#

Before you authorize a team member, set up the following:

• Enable temporary access on the project.
• Create a personal access token in the Supabase Dashboard to call the Management API. If you scope the token, give it Organization Members with Read access and Database JIT with Read-write access.
• Confirm that the team member has access to the project.

Authorize a team member#

To authorize a team member:

1. Set your access token, project ref, and organization slug:

   1
   export SUPABASE_MANAGEMENT_API_TOKEN="your-access-token"
   2
   export PROJECT_REF="your-project-ref"
   3
   export ORG_SLUG="your-org-slug"

   The organization slug is the part of your organization's URL in the Supabase Dashboard that follows /org/.

2. List the organization's members, and copy the user_id of the team member you want to authorize:

   1
   curl "https://api.supabase.com/v1/organizations/$ORG_SLUG/members" \
   2
     -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN"

3. Map the team member to the roles they can assume. Each request replaces the team member's mappings, so list every role they need. To restrict access from the start, add the fields from Restrict a team member's access to this request:

   1
   export MEMBER_USER_ID="the-member-user-id"
   2
   3
   curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit" \
   4
     -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
   5
     -H "Content-Type: application/json" \
   6
     -d @- <<EOF
   7
   {
   8
     "user_id": "$MEMBER_USER_ID",
   9
     "roles": [{ "role": "postgres" }]
   10
   }
   11
   EOF

   This example maps the postgres role, which has broad privileges on your database. If the team member needs less, map a narrower role.

The team member can now connect as the postgres role, with their access token as the password. For connection strings, see Using temporary access.

Restrict a team member's access#

Each role in the mapping takes two optional restrictions:

• expires_at: a Unix timestamp in seconds. After it passes, the database rejects the connection, even if the access token is still valid.
• allowed_networks: the CIDR ranges the team member can connect from. Put IPv4 ranges in allowed_cidrs and IPv6 ranges in allowed_cidrs_v6.

This example uses the variables from Authorize a team member. It limits the postgres role to one IPv4 address for seven days. Replace 203.0.113.10/32 with the address or range the team member connects from:

1
export EXPIRES_AT=$(( $(date +%s) + 7 * 24 * 60 * 60 ))
2
3
curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit" \
4
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
5
  -H "Content-Type: application/json" \
6
  -d @- <<EOF
7
{
8
  "user_id": "$MEMBER_USER_ID",
9
  "roles": [
10
    {
11
      "role": "postgres",
12
      "expires_at": $EXPIRES_AT,
13
      "allowed_networks": {
14
        "allowed_cidrs": [{ "cidr": "203.0.113.10/32" }]
15
      }
16
    }
17
  ]
18
}
19
EOF

Remove a team member's access#

To remove all of a team member's role mappings, send a delete request:

1
curl -X DELETE "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit/$MEMBER_USER_ID" \
2
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN"