Supabase

Creates a 'publishable' or 'secret' API key for an existing Supabase project, optionally with a description; 'secret' keys can have customized JWT templates.

Permanently deletes a specific API key (identified by `id`) from a Supabase project (identified by `ref`), revoking its access.

Removes a third-party authentication provider (e.g., Google, GitHub) from a Supabase project's configuration; this immediately prevents users from logging in via that method.

Retrieves the detailed configuration for a specific third-party authentication (TPA) provider, identified by `tpa_id`, within an existing Supabase project specified by `ref`.

Lists all configured third-party authentication provider integrations for an existing Supabase project (using its `ref`), suitable for read-only auditing or verifying current authentication settings.

Updates an existing Supabase project API key's `description` and/or `secret_jwt_template` (which defines its `role`); does not regenerate the key string.

Tool to apply database migrations to a Supabase project. Use when you need to execute SQL schema changes, create tables, alter columns, or run other DDL/DML operations as part of a tracked migration. This is a Beta feature in the Supabase Management API.

Activates a previously configured custom hostname for a Supabase project, assuming DNS settings are verified externally.

Activates a vanity subdomain for the specified Supabase project (e.g., 'my-brand.supabase.co'). Important notes: - Vanity subdomains require a paid plan (Pro/Team/Enterprise) - Usage of vanity subdomains and custom domains is mutually exclusive - After activation, your project's auth services will no longer work on the original {project-ref}.supabase.co hostname - Schedule a downtime window to update client code and OAuth providers before activating

Generates a Supabase OAuth 2.0 authorization URL for user redirection. IMPORTANT: This action requires a pre-registered OAuth client_id and a redirect_uri that matches one of the pre-registered URIs for that OAuth application. Without a valid registered OAuth application, this endpoint will return a 400 error. To use this action: 1. Register an OAuth application in the Supabase dashboard 2. Use the client_id from the registered application 3. Ensure redirect_uri matches one of the registered callback URLs

Checks if a specific vanity subdomain is available for a Supabase project; this action does not reserve or assign the subdomain.

Provisions a read-only replica for a Supabase project in a specified, Supabase-supported AWS region to enhance read performance and reduce latency.

Enables database webhooks for the Supabase project `ref`, triggering real-time notifications for INSERT, UPDATE, or DELETE events.

Retrieves a Supabase project's custom hostname configuration, including its status, SSL certificate, and ownership verification, noting that availability may depend on the project's plan.

Retrieves the list of banned IPv4 addresses for a Supabase project using its unique project reference string; this is a read-only operation.

Retrieves the network restriction settings (IP allowlists) for a Supabase project. Use this action to: - Check which IPv4/IPv6 CIDR blocks are allowed to connect to the project's database - Verify if network restrictions are enabled (entitlement: "allowed") or disabled ("disallowed") - Audit current network security configuration - Check if network restrictions have been modified (old_config present) Note: Default values 0.0.0.0/0 (IPv4) and ::/0 (IPv6) mean all IPs are allowed. Network restrictions require a Pro, Team, or Enterprise plan.

Retrieves the PGSodium configuration, including the root encryption key, for an existing Supabase project identified by its `ref`.

Retrieves the SSL enforcement configuration for a specified Supabase project, indicating if SSL connections are mandated for its database.

Fetches the current vanity subdomain configuration, including its status and custom domain name, for a Supabase project identified by its reference ID.

Removes specified IPv4 addresses from a Supabase project's network ban list, granting immediate access; IPs not currently banned are ignored.

Remove a read replica from a Supabase project (Pro plan or higher required). This beta endpoint initiates the removal of a specified read replica database. The operation is irreversible. Before removal, ensure all application traffic is redirected from the replica to the primary database. Requirements: - Project must be on Pro plan or higher - Bearer token with infra_read_replicas_write permission (FGA) - Valid read replica database identifier Note: Returns 201 on success with an empty response body.

Executes a given SQL query against the project's database; use for advanced data operations or when standard API endpoints are insufficient, ensuring queries are valid PostgreSQL and sanitized. Use the get_table_schemas or generate_type_script_types tool to retrieve the table schema, then base your query on it.

Updates and applies network access restrictions (IPv4/IPv6 CIDR lists) for a Supabase project, which may terminate existing connections not matching the new rules.

Initiates an asynchronous upgrade of a Supabase project's PostgreSQL database to a specified `target_version` from a selected `release_channel`, returning a `tracking_id` to monitor status; the `target_version` must be available in the chosen channel.

Counts the number of action runs for a Supabase project using a HEAD request. Use this when you need to retrieve the total count of action runs without fetching the full list of runs.

Creates a new Supabase project, requiring a unique name (no dots) within the organization; project creation is asynchronous.

Tool to bulk create secrets for a Supabase project. Use when you need to create multiple project secrets at once. Each secret name must not start with SUPABASE_.

Creates a new, isolated database branch from an existing Supabase project (identified by `ref`), useful for setting up separate environments like development or testing, which can optionally be linked to a Git branch.

Creates a new serverless Edge Function for a Supabase project (identified by `ref`), requiring valid JavaScript/TypeScript in `body` and a project-unique `slug` identifier.

Creates a temporary CLI login role for database access with specified permissions; use when setting up CLI authentication for development or administrative tasks.

Creates a new Supabase organization, which serves as a top-level container for projects, billing, and team access.

Create a new signing key for JWT authentication in a Supabase project. The key is created in standby status by default and must be activated separately.

Creates a new SAML 2.0 Single Sign-On (SSO) provider for a Supabase project, requiring either `metadata_xml` or `metadata_url` for SAML IdP configuration.

Call this to add a new third-party authentication method (OIDC or JWKS) to a Supabase project for integrating external identity providers (e.g., for SSO); the API may also support `custom_jwks` if sent directly.

Disables preview branching for a Supabase project, which deletes all remaining branches. IMPORTANT: Before calling this endpoint, you must manually delete all non-default branches. The API will reject the request with a 422 error if non-default branches exist. Use this action when you need to completely disable the preview branching feature for a project. This action is irreversible - all branches will be permanently removed and preview branching will be disabled. Requirements: - Preview branching must be enabled on the project - All non-default branches must be deleted first - Project must be on Pro plan or above to have preview branching

Deletes an active custom hostname configuration for the project identified by `ref`, reverting to the default Supabase-provided hostname; this action immediately makes the project inaccessible via the custom domain and requires subsequent updates to client, OAuth, and DNS settings.

Permanently and irreversibly deletes a specific, non-default database branch by its `branch_id`, without affecting other branches.

Deletes an Edge Function from a Supabase project by its slug. Use this action when you need to permanently remove a deployed Edge Function that is no longer needed or should be replaced. This action is irreversible — the function cannot be recovered once deleted, though you can redeploy it from source if needed.

Permanently deletes a specific Edge Function (by `function_slug`) from a Supabase project (by `ref`); this action is irreversible and requires prior existence of both project and function.

[Beta] Deletes existing login roles used by the Supabase CLI for the specified project. Use when you need to remove CLI authentication roles that were previously created for project access.

Permanently and irreversibly deletes a Supabase project and all associated resources, including databases, storage, and configurations. This action is irreversible — the project cannot be recovered once deleted. Use when you need to completely remove a project from your organization.

Permanently and irreversibly deletes an active vanity subdomain configuration for the specified Supabase project, reverting it to its default Supabase URL.

Deletes one or more secrets from a Supabase project by their names. This action is irreversible - deleted secrets cannot be recovered. Use this action when you need to remove environment variables or configuration secrets that are no longer needed or should be replaced. Supports both single and bulk deletion operations through the same endpoint.

Deletes a specific SSO provider by its ID (`provider_id`) from a Supabase project (`ref`), which disables it and returns its details; ensure this action will not inadvertently lock out users.

Deploys Edge Functions to a Supabase project using multipart upload.

Disables the preview branching feature for an existing Supabase project, identified by its unique reference ID (`ref`). Note: Preview branching must be enabled on the project for this operation to succeed. If the project does not have preview branching enabled, a 422 error will be returned.

Temporarily disables a Supabase project's read-only mode for 15 minutes to allow write operations (e.g., for maintenance or critical updates), after which it automatically reverts to read-only.

(Beta) Implements the OAuth 2.0 token endpoint to exchange an authorization code or refresh token for access/refresh tokens, based on `grant_type`. This is a standard OAuth 2.0 token endpoint that uses application/x-www-form-urlencoded content type as per OAuth 2.0 specification. Requires a valid registered OAuth application client_id and client_secret. For authorization_code grant type: - Requires valid authorization code obtained from the OAuth authorization flow - Optionally requires code_verifier if PKCE was used during authorization For refresh_token grant type: - Requires valid refresh_token from a previous token exchange

Generates and retrieves TypeScript types from a Supabase project's database; any schemas specified in `included_schemas` must exist in the project.

Retrieves the status and details of a specific action run, including its steps, timestamps, and configuration. Use this to monitor or check the progress of an action execution.

Retrieves the execution logs for a specific action run by its ID. Use this to debug action executions, view output messages, and investigate errors that occurred during action runs.

Retrieves the complete authentication configuration for a Supabase project. Use this action when you need to inspect auth settings, OAuth provider configurations, MFA policies, email/SMS templates, security policies, or webhook hooks. Returns all auth configuration fields including enabled providers (Apple, Google, GitHub, etc.), JWT settings, rate limits, password requirements, session policies, and mailer configuration. This is a read-only operation that does not modify any settings.

Tool to get the list of available regions for creating a new Supabase project. Use when you need to determine which regions are available for project deployment, or to get region recommendations based on geographic location and instance size requirements. Note: This is a Beta endpoint.

Retrieves detailed information about a specific database branch by its name and project reference. Use this to check branch status, configuration, and metadata before performing operations on the branch.

Retrieves the read-only configuration and status for a Supabase database branch, typically for monitoring or verifying its settings.

Gets database metadata for the given project. Returns information about databases, schemas, and tables structure. Note: This endpoint is deprecated and may be removed in future versions.

Retrieves detailed information, metadata, configuration, and status for a specific Edge Function using its project reference ID and function slug.

Retrieves the source code (body) for a specified serverless Edge Function using its project reference and function slug; this is a read-only operation that does not execute the function or return runtime logs.

Tool to check the health status of the Supabase API. Use when you need to verify API availability or troubleshoot connectivity issues.

[Beta] Retrieves the project's just-in-time (JIT) access configuration, including user roles and their expiration settings. Use this to check temporary access grants and their validity periods.