Supabase provides hosted Postgres, authentication, storage, and backend services. Use OAuth for user-delegated control-plane access, or a dedicated access token for an isolated non-production project.
This guide covers Supabase-side preparation for an MCP server. The Supabase agent template is separate from Supabase organization, project, and database access setup.
Choose a connection method
Choose OAuth when the MCP implementation supports user-delegated control-plane access. Choose a dedicated personal access token for a named unattended user and pair it with a restricted database role when database access is needed. Supabase's access-token guide and database-role guidance cover both layers.
Recommended: OAuth
Use OAuth for user-delegated control-plane access. The hosted Supabase MCP server uses browser OAuth and supports Dynamic Client Registration, so Dome's Supabase template does not require you to create a Supabase OAuth app, provide a client ID or secret, or register a callback URI. Import the template, select Connect on its Supabase connection, and sign in with the least-privileged user for an isolated test project.
The template uses the remote server's read_only=true endpoint. Confirm that
the consented user has access only to the intended non-production project. For
database operations outside this read-only MCP setup, use a restricted
database role and retain row-level security; never use the service-role key as
a generic MCP credential.
Alternative: Dedicated access token
For an unattended server, create a personal access token for a dedicated Supabase user limited to a non-production project. Pair it with a database role that has only the required schema and table privileges, keep row-level security enabled, and verify that a production project or unauthorized table is unavailable.
Supabase's access-token guide and database roles guidance are the authority for current setup.
Verify Supabase MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Supabase MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Supabase boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
Control-plane API credentials, database connection strings, anon keys, and service_role keys serve different purposes. A failed database action should be fixed with a narrowly scoped database role or RLS policy—not by supplying service_role.
Next steps
Deploy the Supabase agent template to create a governed agent in Dome that can work with the approved project and database roles, with the template's included model, tools, and rules.
