Scope your Personal Access Tokens

From the source

A Personal Access Token can do anything you can do in your Supabase account, across every organization and project you belong to. Until now, every tool you gave one to could access everything in your account, even when it only needed to perform a single, read-only task. Your CI pipelines, deployment scripts, and AI coding agents all have different jobs and their access should reflect that. Now you can scope a token so what it's permitted to do matches the tool's job. If a coding agent only needs to read one project's database, you hand it a token limited to that project and that one read permission. Token scoping became generally available on September 28, and we announced it at Supabase Select on October 2. Every token you create in the Dashboard is now scoped by default, although you can still create one with full account access if you need to. Nearly nine out of 10 tokens created there since launch have been scoped. Building a token for the job # Take the coding agent from above. It needs to inspect tables, generate types, and run read-only SQL, but it shouldn't be able to write to your database or access other projects.

Announced

26 Oct 2026

First seen by forck

26 Oct 2026 20:28 UTC

Supabase Middleware: composable, reusable middleware for Web Fetch handlers

Composable, reusable middleware for Web Fetch handlers

• Sync real-time Stripe data to Supabase with Stripe Data Pipeline

  Stripe Data Pipeline now syncs to Supabase Postgres

  Supabase· 15 OctCapability change
  

• A local Supabase project per agent, with or without Docker

  Supabase CLI runs multiple local projects per machine, one per git worktree, without Docker.

  Supabase· 14 OctCapability change