Personal Access Tokens
Limit a token to the organizations, projects, and permissions its job needs.
Personal Access Tokens authenticate your CLI, scripts, CI pipelines, and AI coding agents to your Supabase account. You can limit each token to the organizations, projects, and permissions its job needs, instead of handing a tool access to everything you can reach.
Tokens you create in the Dashboard are scoped by default. Access is checked on every request and never exceeds your own role.
Key benefits
- Least privilege: Give a CI pipeline or coding agent a token limited to one project and the permissions its job needs.
- Contained leaks: A leaked token exposes only what it was scoped to, not your whole account.
- Review before you create: A review screen shows what a token can reach before you create it.
- Expiry: Set an expiry date so a temporary tool doesn't hold a token forever.
- Bounded by your role: A token never has more access than you do. If you lose access to a project, the token does too.
- Works where you work: Use a token with the CLI, the Management API, and the Supabase MCP server.
Personal Access Tokens are particularly valuable for:
- CI pipelines that deploy a single project
- AI coding agents connected through the Supabase MCP server
- Scripts and tools that do one narrow task
- Developers who belong to several organizations and want a token that reaches only one
Frequently asked questions
Can I change a token's scope after I create it?
No. A token's scope is fixed when you create it. To change it, create a replacement token.
Can I scope the token that Supabase login creates?
Not yet. supabase login in the browser creates a token with full account access today. Create the token in the Dashboard and pass it with supabase login --token.
What happens if I lose access to a project?
The token loses that access too. If your access is restored, the token works again.
Get started with the Personal Access Tokens documentation.