Giving your AI tool a Supabase token? Limit it to one project
Ship ItChecked against the official source
Source checked 1 Nov 2026 · Published 1 Nov 2026 · Last reviewed 1 Nov 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Supabase's changelog of October 6, 2026: scoped personal access tokens are now available to everyone. You can limit a token to specific projects or organizations and grant only the permissions it needs. They work with the Management API, the Supabase MCP server and the CLI. A leaked scoped token exposes far less than an account-level one.
What to do
- On your access tokens page, choose the resources: selected projects in one organization, or all projects in selected organizations.
- Choose read or read-write per capability, such as projects, database, auth or storage, and an expiry up to one year out.
- Swap each account-level token for a scoped token with only the access its integration needs.
Good to know
- SQL runs read-only unless the token has Database read-write.
- A token never has more access than you do, and you can't change a token's access later: delete it and create a new one. You see the token value only once.
- Existing account-level tokens keep working until they expire or you delete them.
Source
Checked on 1 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.