Supabase CLI: "failed SASL auth" or "invalid SCRAM server-final-message"

When executing supabase db push --remote or supabase link or any other authenticated actions from the Supabase CLI, you might encounter an authentication error with messages such as failed SASL auth (invalid SCRAM server-final-message received from server).

Why This Occurs: This typically indicates an authentication failure where the shared pooler (Supavisor) in certain scenarios may be incorrectly caching credentials for the internal Supabase role cli_login_postgres used for password-less flows with the CLI. This can lead to the your IP being temporarily banned from repeated failed attempts to connect.

To resolve this, consider one of the following solutions:

1. Check Network Bans:

   • Navigate to your project’s Database Settings page.
   • Review any listed IP addresses that are blocked. Remove any entries that correspond to your current connection and then try the CLI action again.

2. Use the old Password-Based authentication flow instead:

   • Provide your database password directly through an environment variable when running the CLI command.

   1
   SUPABASE_DB_PASSWORD=<your-database-password> supabase db push --remote

3. Skip the Pooler and connect directly to the database with the Supabase CLI (Requires IPv6):

   • If your network supports IPv6, pass --skip-pooler to supabase link to bypass the connection pooler and avoid this issue.

   1
   npx supabase link --skip-pooler
   2
   npx supabase db push --remote

Related topics

• Connecting to Postgres
• Permission denied when deleting the cli_login_postgres role
• Supavisor error: password authentication failed after password rotation
• FATAL: password authentication failed
• Tenant or user not found

Go to the GitHub discussion