# Supabase — Scope your Personal Access Tokens

- Company: Supabase (supabase.com)
- Announced: 2026-10-26
- Category: capability-change
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://supabase.com/blog/scope-your-personal-access-tokens
- Record: https://forck.live/items/27973-scope-your-personal-access-tokens
- Subject: Supabase

Supabase now lets users scope Personal Access Tokens to specific projects and permissions, so tools like CI pipelines and coding agents no longer need full account access. Previously a token could do anything its owner could do across every organization and project, even when the tool only needed one read-only task. Token scoping became generally available on September 28 and was announced at Supabase Select on October 2; every token created in the Dashboard is now scoped by default, though full-access tokens remain an option. Nearly nine out of 10 tokens created there since launch have been scoped. Scoped tokens use the prefix sbp_fc and work with the Management API, MCP server and CLI through standard bearer authentication, with a 403 response naming any missing permission. A token's permissions are bounded by the owner's own account, so losing access to a project also removes it from the token. Existing tokens keep working, with no deprecation or shutoff date, and full-access tokens carry a "Legacy" badge in the Dashboard.

## Evidence

Verbatim from https://supabase.com/blog/scope-your-personal-access-tokens:

> A Personal Access Token can do anything you can do in your Supabase account, across every organization and project you belong to. Until now, every tool you gave one to could access everything in your account, even when it only needed to perform a single, read-only task. Your CI pipelines, deployment scripts, and AI coding agents all have different jobs and their access should reflect that.
> 
> Now you can scope a token so what it's permitted to do matches the tool's job. If a coding agent only needs to read one project's database, you hand it a token limited to that project and that one read permission.
> 
> Token scoping became generally available on September 28, and we announced it at Supabase Select on October 2. Every token you create in the Dashboard is now scoped by default, although you can still create one with full account access if you need to. Nearly nine out of 10 tokens created there since launch have been scoped.
> 
> Building a token for the job #
> 
> Take the coding agent from above. It needs to inspect tables, generate types, and run read-only SQL, but it shouldn't be able to write to your database or access other projects.

---

Record: https://forck.live/items/27973-scope-your-personal-access-tokens
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md