Scoped personal access tokens (PATs) are now generally available (GA)

Scoped PATs are now available to everyone. You can limit a token to specific projects or organizations and grant only the permissions it needs. Until now, a PAT could do anything your account could do.

You pick a token's access when you create it#

On your access tokens page, choose:

• Resources: selected projects in one organization, or all projects in selected organizations.
• Permissions: read or read-write per capability, such as projects, database, auth, or storage.
• Expiry: a preset or a custom date up to one year out.

A review step shows the access you're granting and a risk level. You see the token value once, when you create it.

You can't change a token's access later. To change it, delete the token and create a new one. Tokens from the alpha don't get permissions we added since, such as API Key Secrets. Create a new token to get them.

A token never has more access than you do. Every request checks your current role, so the token loses access when you do.

Scoped tokens work with the Management API, MCP server, and CLI#

• Management API: all /v1 and /v2 endpoints. A 403 lists the permissions the token lacks in a missing_permissions array.
• Supabase MCP server: each tool checks the token's permissions. The token's detail view in the dashboard lists the tools it can call.
• Supabase CLI: pass the token with supabase login --token or set SUPABASE_ACCESS_TOKEN. The browser flow for supabase login still creates an account-level token. supabase whoami doesn't work with project- or organization-scoped tokens.

Some access needs a specific permission. Revealing secret API keys needs API Key Secrets. SQL runs read-only unless the token has Database read-write.

The personal access tokens docs map each permission to its endpoints and MCP tools.

Your existing tokens keep working#

We aren't revoking anything. Every existing token works until it expires or you delete it. You can still create an account-level token with "Create legacy token", but a leaked scoped token exposes far less. GitHub secret scanning detects both kinds.

Replace your account-level tokens with scoped ones#

Swap each account-level token for a scoped token that has only the access its integration needs. If you're missing a permission or the form doesn't fit your workflow, comment below.