Connect AI agents to Supabase

branch_id_or_refstringrequired

The 20-character branch reference (lowercase letters, same format as a project ref) or, for legacy branches, the branch UUID. Found in the Supabase dashboard for the branch you want to diff.

included_schemasstring

Comma-separated list of Postgres schema names to include in the diff (e.g. "public,auth"). If omitted, the API's default schema selection is used.

pgdeltaboolean

When true, use pg-delta instead of Migra to compute the schema diff. Defaults to false (Migra).default false

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

included_schemasstring

Comma-separated list of database schemas to include when generating types. Example: public,auth. Defaults to public.default public

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

run_idstringrequired

The unique ID of the action run to look up, as returned by list_action_runs or when a branch action was triggered.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

run_idstringrequired

The unique ID of the action run whose logs you want to retrieve, as returned by list_action_runs or get_action_run.

refstringrequired

The Supabase project reference ID, a 20-character lowercase string that identifies the project. Found in the project URL or Project Settings.

organization_slugstringrequired

The organization's slug identifier, as shown in the Supabase dashboard URL (e.g. app.supabase.com/org/<slug>).

continentstring

Continent code used to bias region recommendations. One of NA (North America), SA (South America), EU (Europe), AF (Africa), AS (Asia), OC (Oceania), AN (Antarctica).one of NASAEUAFASOCAN

desired_instance_sizestring

Desired compute instance size, used to filter regions that support it. Omit to default to the smallest possible size. One of nano, micro, small, medium, large, xlarge, 2xlarge, 4xlarge, 8xlarge, 12xlarge, 16xlarge, 24xlarge, 24xlarge_optimized_memory, 24xlarge_optimized_cpu, 24xlarge_high_memory, 48xlarge, 48xlarge_optimized_memory, 48xlarge_optimized_cpu, 48xlarge_high_memory.one of nanomicrosmallmediumlargexlarge2xlarge4xlarge8xlarge12xlarge16xlarge24xlarge24xlarge_optimized_memory24xlarge_optimized_cpu24xlarge_high_memory48xlarge48xlarge_optimized_memory48xlarge_optimized_cpu48xlarge_high_memory

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

namestringrequired

Name of the branch to retrieve, e.g. 'preview-login-page'.

refstringrequired

Project reference ID (20-character lowercase string) that owns the branch.

branch_id_or_refstringrequired

Branch reference (20-character lowercase string) or the deprecated branch UUID.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

schemastring

The database schema to generate the PostgREST OpenAPI spec for. Defaults to public.default public

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

function_slugstringrequired

Slug (identifier) of the Edge Function to retrieve, e.g. 'hello-world'. Alphanumeric characters, underscores, and hyphens only.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

function_slugstringrequired

Slug (identifier) of the Edge Function whose source code you want, e.g. 'hello-world'. Alphanumeric characters, underscores, and hyphens only.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

versionstringrequired

The migration version identifier, typically a numeric timestamp (e.g., 20250312000000) matching the migration filename prefix.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

slugstringrequired

Slug (identifier) of the organization to look up, e.g. 'tsrqponmlkjihgfedcba'.

slugstringrequired

The organization's slug identifier, as shown in the Supabase dashboard URL (e.g. app.supabase.com/org/<slug>).

slugstringrequired

Slug (identifier) of the organization previewing the claim.

tokenstringrequired

The project claim token, obtained from Create Project Claim Token.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

tracking_idstring

Optional tracking ID returned when the upgrade was initiated, used to look up the status of that specific upgrade attempt. Example: 9f4d3a20-6b2e-4a7e-8c91-1d5f3e7a2b4c.

refstringrequired

The project ref to fetch the PostgREST config for. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

This tool takes no inputs.

refstringrequired

The project ref to fetch. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

idstringrequired

The UUID of the API key to fetch.

refstringrequired

The project ref the API key belongs to. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

revealboolean

Whether to include the plaintext API key value in the response. Defaults to false.default false

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

revealboolean

Whether to reveal the actual secret values of the API keys (hash, api_key) in the response. Defaults to false (redacted) when omitted.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

function_idstringrequired

UUID of the Edge Function to get statistics for.

intervalstringrequired

Bucket size for the returned statistics.one of 15min1hr3hr1day

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The Supabase project reference ID, a 20-character lowercase string that identifies the project. Found in the project URL or Project Settings.

iso_timestamp_endstring

End of the time range to query, as an ISO 8601 timestamp. Must be paired with iso_timestamp_start and the range must not exceed 24 hours.

iso_timestamp_startstring

Start of the time range to query, as an ISO 8601 timestamp. Must be paired with iso_timestamp_end and the range must not exceed 24 hours.

sqlstring

A custom SQL query written in ClickHouse SQL dialect to execute against the log stream. Filter by the "source" column to target specific log sources such as edge_logs or postgres_logs.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

idstringrequired

UUID of the signing key to retrieve.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The Supabase project reference ID, a 20-character lowercase string that identifies the project. Found in the project URL or Project Settings.

refstringrequired

The Supabase project reference ID, a 20-character lowercase string that identifies the project. Found in the project URL or Project Settings.

tpa_idstringrequired

The unique ID (UUID) of the third-party auth integration to retrieve.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

intervalstring

Bucket size for the returned time series.one of 15min30min1hr3hr1day3day7day

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

slugstringrequired

Slug of the organization whose projects to list. Example: 'tsrqponmlkjihgfedcba'.

limitinteger

Number of projects to return per page. Between 1 and 100. Defaults to 100.default 100

offsetinteger

Number of projects to skip for pagination. Defaults to 0.default 0

searchstring

Search projects by name (case-insensitive substring match).

sortstring

Sort order for the returned projects. One of: name_asc, name_desc, created_asc, created_desc. Defaults to name_asc.one of name_ascname_desccreated_asccreated_descdefault name_asc

statusesstring

Comma-separated list of project statuses to filter by, e.g. 'ACTIVE_HEALTHY,INACTIVE'. Supported values include ACTIVE_HEALTHY and INACTIVE.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

namestring

Optional name of a specific restore point to look up. Maximum 20 characters. If omitted, the most recent restore point information is returned.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

lint_typestring

Optional filter restricting results to a specific lint type. Currently only 'sql' is supported.one of sql

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

servicesarrayrequired

Array of service names to check the health of. Each entry must be one of: auth, db, db_postgres_user, pooler, realtime, rest, storage, pg_bouncer. Example: ["auth", "rest"].

timeout_msinteger

Optional timeout in milliseconds for each service health check, between 0 and 10000. Example: 2000.

idstringrequired

The UUID of the SQL snippet to retrieve, as shown in the Supabase SQL Editor URL or returned by list_snippets.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

provider_idstringrequired

The UUID of the SSO provider to retrieve.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

limitnumber

Maximum number of action runs to return per page. KNOWN LIMITATION: Supabase's endpoint requires this as a literal JSON number and does not coerce query-string values, so passing any value here (of any type) currently causes a 400 from Supabase. Omit this field; the API returns all runs without it.

offsetnumber

Number of action runs to skip before starting to return results, for pagination. KNOWN LIMITATION: Supabase's endpoint requires this as a literal JSON number and does not coerce query-string values, so passing any value here (of any type) currently causes a 400 from Supabase. Omit this field; the API returns all runs without it.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

Project reference ID (20-character lowercase string) whose branches to list.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

slugstringrequired

The organization's slug identifier, as shown in the Supabase dashboard URL (e.g. app.supabase.com/org/<slug>).

This tool takes no inputs.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The Supabase project reference ID, a 20-character lowercase string that identifies the project. Found in the project URL or Project Settings.

This tool takes no inputs.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

cursorstring

Opaque pagination cursor from a previous response, used to fetch the next page of results.

limitstring

Maximum number of snippets to return per page. Between 1 and 100.

project_refstring

The 20-character project reference ID to filter snippets to. If omitted, snippets across all accessible projects are returned.

sort_bystring

Field to sort results by: 'name' or 'inserted_at'.one of nameinserted_at

sort_orderstring

Sort direction to apply to sort_by: 'asc' or 'desc'.one of ascdesc

refstringrequired

The Supabase project reference ID, a 20-character lowercase string that identifies the project. Found in the project URL or Project Settings.

querystringrequired

The read-only SQL query to execute. Must be a SELECT-style statement only (no INSERT/UPDATE/DELETE/DDL) and must use fully schema-qualified names (e.g. public.pg_stat_activity).

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

parametersarray

Optional array of positional parameter values to bind into the query (referenced as $1, $2, ... in the SQL). Pass null or omit if the query has no parameters.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

emailstringrequired

Email address the invite was sent to.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

tokenstringrequired

The invite token to accept.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

vanity_subdomainstringrequired

The desired vanity subdomain label (up to 63 characters), e.g. 'acme-prod'. The resulting domain will be <vanity_subdomain>.supabase.co.

querystringrequired

The SQL statements to run as this migration. Cannot be empty.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

idempotency_keystring

A unique key to ensure the same migration is tracked only once, even if this request is retried. Sent as the Idempotency-Key header.

namestring

Optional name for the migration, used to build the migration's file/version label.

rollbackstring

Optional SQL statements that undo this migration, stored alongside it in the migration history for reference.

addon_typestringrequired

The category of addon that addon_variant belongs to.one of custom_domaincompute_instancepitripv4auth_mfa_phoneauth_mfa_web_authnlog_drainetl_pipeline

addon_variantstringrequired

The addon variant to apply. Compute addons (ci_micro..ci_48xlarge_high_memory) resize the project's compute instance. cd_default applies the custom domain addon. pitr_7/pitr_14/pitr_28 enable point-in-time-recovery at that retention window. ipv4_default provisions a dedicated IPv4 address. Example: pitr_7.one of ci_microci_smallci_mediumci_largeci_xlargeci_2xlargeci_4xlargeci_8xlargeci_12xlargeci_16xlargeci_24xlargeci_24xlarge_optimized_cpuci_24xlarge_optimized_memoryci_24xlarge_high_memoryci_48xlargeci_48xlarge_optimized_cpuci_48xlarge_optimized_memoryci_48xlarge_high_memorycd_defaultpitr_7pitr_14pitr_28ipv4_default

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

rhoststringrequired

IP address of the host requesting database role access. Example: 203.0.113.10.

rolestringrequired

The Postgres role name to authorize for this session. Example: postgres.

refstringrequired

The project ref to create secrets in. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

secretsarrayrequired

Array of secret objects to create, each with a 'name' (must not start with SUPABASE_, max 256 chars) and a 'value' (max 24576 chars). Example: [{"name":"OPENAI_API_KEY","value":"sk-example-secret"}].

functionsarrayrequired

Array of function objects to create or replace. Each item requires id, slug, name, status (ACTIVE, REMOVED, or THROTTLED), and version. Optional fields: created_at (unix epoch ms), verify_jwt, import_map, entrypoint_path, import_map_path, ezbr_sha256. Example: [{"id": "3c078cce-ad70-4148-9f37-4da362789053", "slug": "hello-world", "name": "Hello World", "status": "ACTIVE", "version": 2, "verify_jwt": true, "entrypoint_path": "index.ts"}]

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

vanity_subdomainstringrequired

The vanity subdomain label (up to 63 characters) to check for availability, e.g. 'acme-prod'.

branch_namestringrequired

Unique name for the new branch, e.g. 'preview-login-page'. Must be at least 1 character.

refstringrequired

Project reference ID (20-character lowercase string) to branch from.

desired_instance_sizestring

Compute instance size for the branch database.one of piconanomicrosmallmediumlargexlarge2xlarge4xlarge8xlarge12xlarge16xlarge24xlarge24xlarge_optimized_memory24xlarge_optimized_cpu24xlarge_high_memory48xlarge48xlarge_optimized_memory48xlarge_optimized_cpu48xlarge_high_memory

git_branchstring

Git branch to associate with this database branch, e.g. 'feature/login-page'.

is_defaultboolean

Whether this branch should be marked as the default branch for the project.

notify_urlstring

HTTP endpoint that Supabase calls with branch status updates, e.g. 'https://example.com/webhooks/branches'.

persistentboolean

Whether the branch should persist (not be automatically cleaned up) rather than being an ephemeral preview branch.

postgres_enginestring

Postgres engine version to use for the branch. If not provided, the latest version is used.one of 151717-oriole

regionstring

AWS region to deploy the branch's database in, e.g. 'us-east-1'. Defaults to the parent project's region if omitted.

release_channelstring

Release channel to run the branch on. If not provided, GA (general availability) is used.one of internalalphabetagawithdrawnpreview

secretsobject

Key-value map of secrets (environment variables) to seed into the new branch. Example: {"MY_SECRET": "value"}.

with_databoolean

Whether to copy data from the parent project's production database into the new branch.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

read_onlybooleanrequired

Whether the created role should have read-only database access. Set to true for a read-only role, false for read-write.

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

namestringrequired

Name for the new organization, up to 256 characters, e.g. 'Acme'.

db_passstringrequired

Password for the project's Postgres database. Choose a strong, unique password — it cannot be retrieved later, only reset.

namestringrequired

Name of the project to create. Maximum 256 characters. Example: 'acme-prod'.

organization_slugstringrequired

Slug of the organization that will own the project. Required. Example: 'tsrqponmlkjihgfedcba'.

desired_instance_sizestring

Desired compute instance size for the new project. Omit to default to the smallest possible size. One of: nano, micro, small, medium, large, xlarge, 2xlarge, 4xlarge, 8xlarge, 12xlarge, 16xlarge, 24xlarge, 24xlarge_optimized_memory, 24xlarge_optimized_cpu, 24xlarge_high_memory, 48xlarge, 48xlarge_optimized_memory, 48xlarge_optimized_cpu, 48xlarge_high_memory.one of nanomicrosmallmediumlargexlarge2xlarge4xlarge8xlarge12xlarge16xlarge24xlarge24xlarge_optimized_memory24xlarge_optimized_cpu24xlarge_high_memory48xlarge48xlarge_optimized_memory48xlarge_optimized_cpu48xlarge_high_memory

high_availabilityboolean

Experimental. Whether to enable high availability for the project.

kps_enabledboolean

Deprecated. This field is ignored in this request.

organization_idstring

Deprecated. Use organization_slug instead. Numeric/legacy organization identifier.

planstring

Deprecated. Subscription plan is now set at the organization level and is ignored in this request. One of: free, pro.one of freepro

regionstring

Deprecated. AWS region the project's server resides in. Prefer region_selection instead. One of: us-east-1, us-east-2, us-west-1, us-west-2, ap-east-1, ap-southeast-1, ap-northeast-1, ap-northeast-2, ap-southeast-2, eu-west-1, eu-west-2, eu-west-3, eu-north-1, eu-central-1, eu-central-2, ca-central-1, ap-south-1, sa-east-1.one of us-east-1us-east-2us-west-1us-west-2ap-east-1ap-southeast-1ap-northeast-1ap-northeast-2ap-southeast-2eu-west-1eu-west-2eu-west-3eu-north-1eu-central-1eu-central-2ca-central-1ap-south-1sa-east-1

region_selectionobject

Region selection object. Only one of region or region_selection should be specified. Shape is either {"type":"specific","code":"us-east-1"} or {"type":"smartGroup","code":"americas"} (smartGroup codes: americas, emea, apac).

template_urlstring

Template URL used to create the project from the CLI, as a full URI.

namestringrequired

Name for the new API key. Must be lowercase snake_case, start with a letter or underscore, and be 4-64 characters long. Example: 'ci_secret_key'.

refstringrequired

The project ref to create the API key in. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

typestringrequired

The type of API key to create. One of: publishable, secret.one of publishablesecret

descriptionstring

Optional human-readable description of what this key is used for.

revealboolean

Whether to include the plaintext API key value in the response. Defaults to false.default false

secret_jwt_templateobject

Optional JSON object defining a custom JWT template for this secret key.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

algorithmstringrequired

The signing algorithm for the new key.one of EdDSAES256RS256HS256

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

private_jwkobject

Optional bring-your-own private JWK object (JSON Web Key) to use for this signing key instead of having Supabase generate one. Shape depends on the key type (kty: RSA, EC, or oct) and must include the fields required by that key type (e.g. for RSA: kty, n, e, d, p, q, dp, dq, qi).

statusstring

The initial status of the new signing key. Defaults to standby (not yet used to sign new tokens).one of in_usestandbydefault standby

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

custom_jwksobject

A static JSON Web Key Set object to use directly instead of resolving keys dynamically from jwks_url or oidc_issuer_url. Shape: {"keys": [...]}.

jwks_urlstring

The URL of the third-party provider's JSON Web Key Set (JWKS) endpoint, used to verify JWT signatures. Provide this if oidc_issuer_url is not available.

oidc_issuer_urlstring

The OIDC issuer URL of the third-party auth provider. Supabase uses this to auto-discover the provider's JWKS endpoint.

namestringrequired

A short, human-readable label for the restore point (max 20 characters). Used later to identify this point when restoring. Example: before-upgrade.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

typestringrequired

The type of SSO provider to create. Currently only 'saml' is supported.one of saml

attribute_mappingobject

Mapping of SAML assertion attributes to Supabase user fields. Shape: {"keys": {"<field>": {"name": "<saml_attribute_name>"}}}.

domainsarray

List of email domains that should be routed to this SSO provider for sign-in.

metadata_urlstring

URL to the identity provider's SAML metadata XML document. Provide this or metadata_xml (at least one is required by the SAML provider).

metadata_xmlstring

The identity provider's SAML metadata as an inline XML string. Provide this or metadata_url.

name_id_formatstring

The SAML NameID format the identity provider should use when asserting the user's identifier.one of urn:oasis:names:tc:SAML:1.1:nameid-format:unspecifiedurn:oasis:names:tc:SAML:2.0:nameid-format:transienturn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressurn:oasis:names:tc:SAML:2.0:nameid-format:persistent

entrypoint_pathstringrequired

Relative path of the function's entrypoint file within the uploaded bundle, e.g. 'index.ts'.

file_content_base64stringrequired

Base64-encoded contents of the function's source file (the bundled Deno/TypeScript entrypoint) to upload.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

bundle_onlyboolean

When true, only bundles and validates the function without activating the new deployment. Boolean.default false

file_namestring

Filename to use for the uploaded source file, matching the entrypoint_path (e.g. 'index.ts').default index.ts

import_map_pathstring

Relative path of an import map file (deno.json or import_map.json) within the uploaded bundle, if one is used.

namestring

Display name for the function. If omitted, the slug is used as the display name.

slugstring

Slug (identifier) for the function being deployed, e.g. 'hello-world'. If omitted, the slug is derived from metadata.name.

static_patternsarray

Optional array of glob patterns matching additional static files in the bundle that should be served as-is (not executed).

verify_jwtboolean

Whether Supabase should verify a JWT on incoming requests to this function before invoking it.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

emailstringrequired

Email address of the external user to invite.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

rolesarrayrequired

Array of role objects to grant. Each has a required 'role' name, plus optional 'expires_at' (unix timestamp), 'allowed_networks' ({allowed_cidrs: [{cidr}], allowed_cidrs_v6: [{cidr}]}), and 'branches_only' (boolean).

iopsintegerrequired

Provisioned IOPS for the disk.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

size_gbintegerrequired

Size of the disk in GB.

typestringrequired

The disk type to use.one of gp3io2

throughput_mibpsinteger

Throughput in MiB/s. Only valid when type is gp3.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

versionstringrequired

The version identifier of the migration history entry to patch, as a numeric timestamp string.

namestring

New name to record for this migration history entry. Pass null or omit to leave the existing name unchanged.

rollbackstring

New rollback SQL statement to record for this migration history entry. Pass null or omit to leave the existing rollback SQL unchanged.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

add_ipv4array

Array of IPv4 CIDR ranges to add to the database allow-list. Example: ["203.0.113.0/24"].

add_ipv6array

Array of IPv6 CIDR ranges to add to the database allow-list. Example: ["2001:db8::/32"].

remove_ipv4array

Array of IPv4 CIDR ranges to remove from the database allow-list. Example: ["198.51.100.0/24"].

remove_ipv6array

Array of IPv6 CIDR ranges to remove from the database allow-list. Example: ["2001:db8:1::/48"].

branch_id_or_refstringrequired

The branch's project ref (20-character lowercase string) or the deprecated UUID branch ID.

read_replica_regionstringrequired

The region the read replica should reside in.one of us-east-1us-east-2us-west-1us-west-2ap-east-1ap-southeast-1ap-northeast-1ap-northeast-2ap-southeast-2eu-west-1eu-west-2eu-west-3eu-north-1eu-central-1eu-central-2ca-central-1ap-south-1sa-east-1

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

run_idstringrequired

The unique ID of the action run whose step statuses are being updated.

clonestring

New status for the 'clone' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

configurestring

New status for the 'configure' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

deploystring

New status for the 'deploy' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

healthstring

New status for the 'health' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

migratestring

New status for the 'migrate' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

pullstring

New status for the 'pull' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

seedstring

New status for the 'seed' step. One of CREATED, DEAD, EXITED, PAUSED, REMOVING, RESTARTING, RUNNING.one of CREATEDDEADEXITEDPAUSEDREMOVINGRESTARTINGRUNNING

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

api_max_request_durationinteger

Maximum duration, in seconds, Auth allows for a single API request before timing out.

custom_oauth_enabledboolean

Whether custom (non-catalog) OAuth provider configurations are enabled for this project.

db_max_pool_sizeinteger

Maximum size of the database connection pool used by the Auth service.

db_max_pool_size_unitstring

Unit for db_max_pool_size: a fixed number of connections, or a percentage of the project's total available connections.one of connectionspercent

disable_signupboolean

Whether to disable new user signups. When true, only existing users can sign in; new signups are rejected.

external_anonymous_users_enabledboolean

Whether anonymous sign-ins are enabled for the project.

external_apple_additional_client_idsstring

Comma-separated list of additional OAuth client IDs accepted for Sign in with Apple (e.g. for multiple native apps).

external_apple_client_idstring

OAuth client ID registered with Apple, used for Sign in with Apple.

external_apple_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Apple.

external_apple_enabledboolean

Whether Sign in with Apple is enabled for this project.

external_apple_secretstring

OAuth client secret registered with Apple, used for Sign in with Apple. Treated as a secret.

external_azure_client_idstring

OAuth client ID registered with Azure, used for Sign in with Azure.

external_azure_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Azure.

external_azure_enabledboolean

Whether Sign in with Azure is enabled for this project.

external_azure_secretstring

OAuth client secret registered with Azure, used for Sign in with Azure. Treated as a secret.

external_azure_urlstring

Base URL of the self-hosted/on-prem Azure instance to authenticate against.

external_bitbucket_client_idstring

OAuth client ID registered with Bitbucket, used for Sign in with Bitbucket.

external_bitbucket_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Bitbucket.

external_bitbucket_enabledboolean

Whether Sign in with Bitbucket is enabled for this project.

external_bitbucket_secretstring

OAuth client secret registered with Bitbucket, used for Sign in with Bitbucket. Treated as a secret.

external_discord_client_idstring

OAuth client ID registered with Discord, used for Sign in with Discord.

external_discord_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Discord.

external_discord_enabledboolean

Whether Sign in with Discord is enabled for this project.

external_discord_secretstring

OAuth client secret registered with Discord, used for Sign in with Discord. Treated as a secret.

external_email_enabledboolean

Whether email-based sign-up and sign-in (password or OTP) is enabled.

external_facebook_client_idstring

OAuth client ID registered with Facebook, used for Sign in with Facebook.

external_facebook_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Facebook.

external_facebook_enabledboolean

Whether Sign in with Facebook is enabled for this project.

external_facebook_secretstring

OAuth client secret registered with Facebook, used for Sign in with Facebook. Treated as a secret.

external_figma_client_idstring

OAuth client ID registered with Figma, used for Sign in with Figma.

external_figma_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Figma.

external_figma_enabledboolean

Whether Sign in with Figma is enabled for this project.

external_figma_secretstring

OAuth client secret registered with Figma, used for Sign in with Figma. Treated as a secret.

external_github_client_idstring

OAuth client ID registered with Github, used for Sign in with Github.

external_github_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Github.

external_github_enabledboolean

Whether Sign in with Github is enabled for this project.

external_github_secretstring

OAuth client secret registered with Github, used for Sign in with Github. Treated as a secret.

external_gitlab_client_idstring

OAuth client ID registered with Gitlab, used for Sign in with Gitlab.

external_gitlab_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Gitlab.

external_gitlab_enabledboolean

Whether Sign in with Gitlab is enabled for this project.

external_gitlab_secretstring

OAuth client secret registered with Gitlab, used for Sign in with Gitlab. Treated as a secret.

external_gitlab_urlstring

Base URL of the self-hosted/on-prem Gitlab instance to authenticate against.

external_google_additional_client_idsstring

Comma-separated list of additional OAuth client IDs accepted for Sign in with Google (e.g. for multiple native apps).

external_google_client_idstring

OAuth client ID registered with Google, used for Sign in with Google.

external_google_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Google.

external_google_enabledboolean

Whether Sign in with Google is enabled for this project.

external_google_secretstring

OAuth client secret registered with Google, used for Sign in with Google. Treated as a secret.

external_google_skip_nonce_checkboolean

When true, skips validating the OIDC nonce claim for Sign in with Google. Only disable this if you understand the replay-attack risk.

external_kakao_client_idstring

OAuth client ID registered with Kakao, used for Sign in with Kakao.

external_kakao_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Kakao.

external_kakao_enabledboolean

Whether Sign in with Kakao is enabled for this project.

external_kakao_secretstring

OAuth client secret registered with Kakao, used for Sign in with Kakao. Treated as a secret.

external_keycloak_client_idstring

OAuth client ID registered with Keycloak, used for Sign in with Keycloak.

external_keycloak_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Keycloak.

external_keycloak_enabledboolean

Whether Sign in with Keycloak is enabled for this project.

external_keycloak_secretstring

OAuth client secret registered with Keycloak, used for Sign in with Keycloak. Treated as a secret.

external_keycloak_urlstring

Base URL of the self-hosted/on-prem Keycloak instance to authenticate against.

external_linkedin_oidc_client_idstring

OAuth client ID registered with LinkedIn (OIDC), used for Sign in with LinkedIn (OIDC).

external_linkedin_oidc_email_optionalboolean

When true, a verified email address is not required to complete Sign in with LinkedIn (OIDC).

external_linkedin_oidc_enabledboolean

Whether Sign in with LinkedIn (OIDC) is enabled for this project.

external_linkedin_oidc_secretstring

OAuth client secret registered with LinkedIn (OIDC), used for Sign in with LinkedIn (OIDC). Treated as a secret.

external_notion_client_idstring

OAuth client ID registered with Notion, used for Sign in with Notion.

external_notion_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Notion.

external_notion_enabledboolean

Whether Sign in with Notion is enabled for this project.

external_notion_secretstring

OAuth client secret registered with Notion, used for Sign in with Notion. Treated as a secret.

external_phone_enabledboolean

Whether phone-based sign-up and sign-in (SMS OTP) is enabled.

external_slack_client_idstring

OAuth client ID registered with Slack, used for Sign in with Slack.

external_slack_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Slack.

external_slack_enabledboolean

Whether Sign in with Slack is enabled for this project.

external_slack_oidc_client_idstring

OAuth client ID registered with Slack (OIDC), used for Sign in with Slack (OIDC).

external_slack_oidc_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Slack (OIDC).

external_slack_oidc_enabledboolean

Whether Sign in with Slack (OIDC) is enabled for this project.

external_slack_oidc_secretstring

OAuth client secret registered with Slack (OIDC), used for Sign in with Slack (OIDC). Treated as a secret.

external_slack_secretstring

OAuth client secret registered with Slack, used for Sign in with Slack. Treated as a secret.

external_spotify_client_idstring

OAuth client ID registered with Spotify, used for Sign in with Spotify.

external_spotify_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Spotify.

external_spotify_enabledboolean

Whether Sign in with Spotify is enabled for this project.

external_spotify_secretstring

OAuth client secret registered with Spotify, used for Sign in with Spotify. Treated as a secret.

external_twitch_client_idstring

OAuth client ID registered with Twitch, used for Sign in with Twitch.

external_twitch_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Twitch.

external_twitch_enabledboolean

Whether Sign in with Twitch is enabled for this project.

external_twitch_secretstring

OAuth client secret registered with Twitch, used for Sign in with Twitch. Treated as a secret.

external_twitter_client_idstring

OAuth client ID registered with Twitter, used for Sign in with Twitter.

external_twitter_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Twitter.

external_twitter_enabledboolean

Whether Sign in with Twitter is enabled for this project.

external_twitter_secretstring

OAuth client secret registered with Twitter, used for Sign in with Twitter. Treated as a secret.

external_web3_ethereum_enabledboolean

Whether Sign-in with Ethereum (Web3 wallet) is enabled.

external_web3_solana_enabledboolean

Whether Sign-in with Solana (Web3 wallet) is enabled.

external_workos_client_idstring

OAuth client ID registered with Workos, used for Sign in with Workos.

external_workos_enabledboolean

Whether Sign in with Workos is enabled for this project.

external_workos_secretstring

OAuth client secret registered with Workos, used for Sign in with Workos. Treated as a secret.

external_workos_urlstring

Base URL of the self-hosted/on-prem Workos instance to authenticate against.

external_x_client_idstring

OAuth client ID registered with X (Twitter), used for Sign in with X (Twitter).

external_x_email_optionalboolean

When true, a verified email address is not required to complete Sign in with X (Twitter).

external_x_enabledboolean

Whether Sign in with X (Twitter) is enabled for this project.

external_x_secretstring

OAuth client secret registered with X (Twitter), used for Sign in with X (Twitter). Treated as a secret.

external_zoom_client_idstring

OAuth client ID registered with Zoom, used for Sign in with Zoom.

external_zoom_email_optionalboolean

When true, a verified email address is not required to complete Sign in with Zoom.

external_zoom_enabledboolean

Whether Sign in with Zoom is enabled for this project.

external_zoom_secretstring

OAuth client secret registered with Zoom, used for Sign in with Zoom. Treated as a secret.

hook_after_user_created_enabledboolean

Whether the 'after user created' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_after_user_created_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'after user created' hook came from Supabase Auth.

hook_after_user_created_uristring

URI Auth calls for the 'after user created' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

hook_before_user_created_enabledboolean

Whether the 'before user created' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_before_user_created_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'before user created' hook came from Supabase Auth.

hook_before_user_created_uristring

URI Auth calls for the 'before user created' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

hook_custom_access_token_enabledboolean

Whether the 'custom access token' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_custom_access_token_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'custom access token' hook came from Supabase Auth.

hook_custom_access_token_uristring

URI Auth calls for the 'custom access token' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

hook_mfa_verification_attempt_enabledboolean

Whether the 'mfa verification attempt' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_mfa_verification_attempt_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'mfa verification attempt' hook came from Supabase Auth.

hook_mfa_verification_attempt_uristring

URI Auth calls for the 'mfa verification attempt' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

hook_password_verification_attempt_enabledboolean

Whether the 'password verification attempt' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_password_verification_attempt_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'password verification attempt' hook came from Supabase Auth.

hook_password_verification_attempt_uristring

URI Auth calls for the 'password verification attempt' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

hook_send_email_enabledboolean

Whether the 'send email' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_send_email_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'send email' hook came from Supabase Auth.

hook_send_email_uristring

URI Auth calls for the 'send email' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

hook_send_sms_enabledboolean

Whether the 'send sms' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.

hook_send_sms_secretsstring

Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'send sms' hook came from Supabase Auth.

hook_send_sms_uristring

URI Auth calls for the 'send sms' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.

jwt_expinteger

Expiry time (in seconds) for access tokens (JWTs) issued by Auth. Between 0 and 604800 (7 days).

mailer_allow_unverified_email_sign_insboolean

Whether users with an unverified email address are allowed to sign in.

mailer_autoconfirmboolean

When true, new users are automatically confirmed without needing to click a confirmation email link.

mailer_notifications_email_changed_enabledboolean

Whether to send a notification email to the user when their email changed occurs.

mailer_notifications_identity_linked_enabledboolean

Whether to send a notification email to the user when their identity linked occurs.

mailer_notifications_identity_unlinked_enabledboolean

Whether to send a notification email to the user when their identity unlinked occurs.

mailer_notifications_mfa_factor_enrolled_enabledboolean

Whether to send a notification email to the user when their mfa factor enrolled occurs.

mailer_notifications_mfa_factor_unenrolled_enabledboolean

Whether to send a notification email to the user when their mfa factor unenrolled occurs.

mailer_notifications_password_changed_enabledboolean

Whether to send a notification email to the user when their password changed occurs.

mailer_notifications_phone_changed_enabledboolean

Whether to send a notification email to the user when their phone changed occurs.

mailer_otp_expinteger

Expiry time (in seconds) for email OTP / magic link tokens.

mailer_otp_lengthinteger

Number of digits in generated email OTP codes. Between 6 and 10.

mailer_secure_email_change_enabledboolean

When true, changing a user's email address requires confirmation from both the old and the new email address.

mailer_subjects_confirmationstring

Subject line used for the 'confirmation' auth email template.

mailer_subjects_email_changestring

Subject line used for the 'email change' auth email template.

mailer_subjects_email_changed_notificationstring

Subject line used for the 'email changed notification' auth email template.

mailer_subjects_identity_linked_notificationstring

Subject line used for the 'identity linked notification' auth email template.

mailer_subjects_identity_unlinked_notificationstring

Subject line used for the 'identity unlinked notification' auth email template.

mailer_subjects_invitestring

Subject line used for the 'invite' auth email template.

mailer_subjects_magic_linkstring

Subject line used for the 'magic link' auth email template.

mailer_subjects_mfa_factor_enrolled_notificationstring

Subject line used for the 'mfa factor enrolled notification' auth email template.

mailer_subjects_mfa_factor_unenrolled_notificationstring

Subject line used for the 'mfa factor unenrolled notification' auth email template.

mailer_subjects_password_changed_notificationstring

Subject line used for the 'password changed notification' auth email template.

mailer_subjects_phone_changed_notificationstring

Subject line used for the 'phone changed notification' auth email template.

mailer_subjects_reauthenticationstring

Subject line used for the 'reauthentication' auth email template.

mailer_subjects_recoverystring

Subject line used for the 'recovery' auth email template.

mailer_templates_confirmation_contentstring

Custom HTML body template for the 'confirmation' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_email_change_contentstring

Custom HTML body template for the 'email change' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_email_changed_notification_contentstring

Custom HTML body template for the 'email changed notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_identity_linked_notification_contentstring

Custom HTML body template for the 'identity linked notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_identity_unlinked_notification_contentstring

Custom HTML body template for the 'identity unlinked notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_invite_contentstring

Custom HTML body template for the 'invite' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_magic_link_contentstring

Custom HTML body template for the 'magic link' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_mfa_factor_enrolled_notification_contentstring

Custom HTML body template for the 'mfa factor enrolled notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_mfa_factor_unenrolled_notification_contentstring

Custom HTML body template for the 'mfa factor unenrolled notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_password_changed_notification_contentstring

Custom HTML body template for the 'password changed notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_phone_changed_notification_contentstring

Custom HTML body template for the 'phone changed notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_reauthentication_contentstring

Custom HTML body template for the 'reauthentication' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mailer_templates_recovery_contentstring

Custom HTML body template for the 'recovery' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).

mfa_max_enrolled_factorsinteger

Maximum number of MFA factors a single user may enroll.

mfa_phone_enroll_enabledboolean

Whether users are allowed to enroll a phone-number (SMS OTP) MFA factor.

mfa_phone_max_frequencyinteger

Minimum number of seconds between MFA SMS challenge messages sent to the same phone number (0-32767).

mfa_phone_otp_lengthinteger

Number of digits in generated MFA phone OTP codes (0-32767).

mfa_phone_templatestring

Custom SMS message template used when sending an MFA phone OTP challenge. Supports the {{ .Code }} variable.

mfa_phone_verify_enabledboolean

Whether phone-number (SMS OTP) MFA verification is enabled at sign-in.

mfa_totp_enroll_enabledboolean

Whether users are allowed to enroll a new TOTP (authenticator app) MFA factor.

mfa_totp_verify_enabledboolean

Whether TOTP (authenticator app) MFA verification is enabled at sign-in.

mfa_web_authn_enroll_enabledboolean

Whether users are allowed to enroll a new WebAuthn (hardware key / platform authenticator) MFA factor.

mfa_web_authn_verify_enabledboolean

Whether WebAuthn MFA verification is enabled at sign-in.

nimbus_oauth_client_idstring

Client ID for Supabase's internal Nimbus OAuth integration (advanced/internal use).

nimbus_oauth_client_secretstring

Client secret for Supabase's internal Nimbus OAuth integration (advanced/internal use). Treated as a secret.

oauth_server_allow_dynamic_registrationboolean

Whether third-party OAuth clients may register themselves dynamically (RFC 7591 Dynamic Client Registration) against this project's OAuth server.

oauth_server_authorization_pathstring

Custom path used for the OAuth authorization endpoint when this project acts as an OAuth server.

oauth_server_enabledboolean

Whether this project can act as an OAuth 2.1 authorization server, issuing tokens to third-party client apps.

passkey_enabledboolean

Whether passkey (WebAuthn passwordless) sign-in is enabled for this project.

password_hibp_enabledboolean

When true, passwords are checked against the Have I Been Pwned breached-password database and rejected if found.

password_min_lengthinteger

Minimum required password length. Between 6 and 32767 characters.

password_required_charactersstring

Character sets that must each appear at least once in a password, expressed as a colon-separated list of character classes (e.g. lowercase:uppercase:digits). Empty string means no requirement.one of abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\:"|<>?,./`~

rate_limit_anonymous_usersinteger

Rate limit on anonymous sign-ins, expressed as a per-hour or per-interval integer cap enforced by Auth.

rate_limit_email_sentinteger

Rate limit on emails sent, expressed as a per-hour or per-interval integer cap enforced by Auth.

rate_limit_otpinteger

Rate limit on OTP requests, expressed as a per-hour or per-interval integer cap enforced by Auth.

rate_limit_sms_sentinteger

Rate limit on SMS messages sent, expressed as a per-hour or per-interval integer cap enforced by Auth.

rate_limit_token_refreshinteger

Rate limit on token refresh requests, expressed as a per-hour or per-interval integer cap enforced by Auth.

rate_limit_verifyinteger

Rate limit on OTP/token verification attempts, expressed as a per-hour or per-interval integer cap enforced by Auth.

rate_limit_web3integer

Rate limit on Web3 (wallet) sign-in attempts, expressed as a per-hour or per-interval integer cap enforced by Auth.

refresh_token_rotation_enabledboolean

Auth config field 'refresh_token_rotation_enabled' (refresh token rotation enabled).

saml_enabledboolean

Whether this project can act as a SAML 2.0 Service Provider for SSO sign-in.

saml_external_urlstring

The external base URL used in this project's SAML Service Provider metadata (issuer / ACS URL).

security_captcha_enabledboolean

Whether CAPTCHA verification is required on sign-up, sign-in, and password recovery.

security_captcha_providerstring

The CAPTCHA provider to use when CAPTCHA is enabled.one of turnstilehcaptcha

security_captcha_secretstring

Secret key for the configured CAPTCHA provider, used to verify CAPTCHA tokens server-side.

security_manual_linking_enabledboolean

Whether users may manually link additional identities/providers to their existing account.

security_refresh_token_reuse_intervalinteger

Grace period, in seconds, during which a previously used (rotated) refresh token is still accepted, to tolerate network retries.

security_sb_forwarded_for_enabledboolean

Whether to trust the 'X-Forwarded-For' header to determine client IP addresses (for rate limiting and logs) when behind a trusted proxy.

security_update_password_require_reauthenticationboolean

Whether users must reauthenticate (re-enter credentials) before changing their password.

sessions_inactivity_timeoutnumber

Number of seconds of inactivity after which a session is revoked. 0 disables the timeout.

sessions_single_per_userboolean

When true, signing in on a new device/browser revokes the user's other active sessions.

sessions_tagsstring

Comma-separated list of tags used to group and manage sessions (e.g. by client type).

sessions_timeboxnumber

Maximum lifetime of a session in seconds, after which the user must sign in again, regardless of activity. 0 disables the limit.

site_urlstring

The base URL of the site, used as an allowed redirect URL for authentication flows (e.g. password recovery, email confirmation links).

sms_autoconfirmboolean

When true, new users signing up with a phone number are automatically confirmed without an SMS OTP challenge.

sms_max_frequencyinteger

Minimum number of seconds between SMS messages sent to the same phone number, for rate limiting (0-32767).

sms_messagebird_access_keystring

MessageBird API access key, required when sms_provider is 'messagebird'.

sms_messagebird_originatorstring

MessageBird originator (sender ID or phone number) shown to recipients, required when sms_provider is 'messagebird'.

sms_otp_expinteger

Expiry time (in seconds) for SMS OTP codes.

sms_otp_lengthinteger

Number of digits in generated SMS OTP codes (0-32767).

sms_providerstring

The SMS delivery provider used to send phone OTP messages.one of messagebirdtextlocaltwiliotwilio_verifyvonage

sms_templatestring

Custom SMS message template used for sign-up/sign-in phone OTP challenges. Supports the {{ .Code }} variable.

sms_test_otpstring

Comma-separated list of phone-number=otp pairs used for test/demo sign-ins without sending real SMS (e.g. '+15555550100=123456').

sms_test_otp_valid_untilstring

ISO 8601 timestamp after which the configured sms_test_otp values stop working.

sms_textlocal_api_keystring

Textlocal API key, required when sms_provider is 'textlocal'.

sms_textlocal_senderstring

Textlocal sender ID shown to recipients, required when sms_provider is 'textlocal'.

sms_twilio_account_sidstring

Twilio Account SID, required when sms_provider is 'twilio'.

sms_twilio_auth_tokenstring

Twilio Auth Token, required when sms_provider is 'twilio'.

sms_twilio_content_sidstring

Twilio Content SID for the WhatsApp/Messaging template used to send OTP codes via Twilio, when applicable.

sms_twilio_message_service_sidstring

Twilio Messaging Service SID used to send OTP messages, required when sms_provider is 'twilio' and a Messaging Service is used instead of a single from-number.

sms_twilio_verify_account_sidstring

Twilio Account SID used with Twilio Verify, required when sms_provider is 'twilio_verify'.

sms_twilio_verify_auth_tokenstring

Twilio Auth Token used with Twilio Verify, required when sms_provider is 'twilio_verify'.

sms_twilio_verify_message_service_sidstring

Twilio Verify Messaging Service SID, required when sms_provider is 'twilio_verify' and a Messaging Service is used.

sms_vonage_api_keystring

Vonage API key, required when sms_provider is 'vonage'.

sms_vonage_api_secretstring

Vonage API secret, required when sms_provider is 'vonage'.

sms_vonage_fromstring

Vonage sender ID or phone number shown to recipients, required when sms_provider is 'vonage'.

smtp_admin_emailstring

The 'from' email address used when Auth sends emails via the configured SMTP server.

smtp_hoststring

Hostname of the custom SMTP server used to send auth emails instead of Supabase's default mailer.

smtp_max_frequencyinteger

Minimum number of seconds between emails sent to the same address, used for rate limiting (0-32767).

smtp_passstring

Password or API key used to authenticate with the custom SMTP server. Treated as a secret.

smtp_portstring

Port number of the custom SMTP server (as a string), e.g. '587' or '465'.

smtp_sender_namestring

Display name shown as the sender on outgoing auth emails.

smtp_userstring

Username used to authenticate with the custom SMTP server.

uri_allow_liststring

Comma-separated list of additional redirect URLs allowed after auth actions (sign-in, sign-up, password reset). Supports wildcards.

webauthn_rp_display_namestring

Human-readable Relying Party name shown to users during passkey/WebAuthn registration prompts.

webauthn_rp_idstring

WebAuthn Relying Party ID — typically your application's domain (without scheme or path).

webauthn_rp_originsstring

Comma-separated list of allowed WebAuthn origins (full URLs, including scheme) that may perform passkey registration/authentication.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

schedule_forstringrequired

Time of day to schedule daily backups, in UTC. Format: HH:MM:SS.

branch_id_or_refstringrequired

Branch reference (20-character lowercase string) or the deprecated branch UUID to update.

branch_namestring

New name for the branch. Leave blank to keep the current name.

git_branchstring

New Git branch to associate with this database branch. Leave blank to keep the current association.

notify_urlstring

HTTP endpoint that Supabase calls with branch status updates, e.g. 'https://example.com/webhooks/branches'.

persistentboolean

Whether the branch should persist rather than being cleaned up as an ephemeral preview branch.

request_reviewboolean

Whether to request a review for this branch (e.g., to trigger a merge/review workflow).

statusstring

Status to set on the branch.one of CREATING_PROJECTRUNNING_MIGRATIONSMIGRATIONS_PASSEDMIGRATIONS_FAILEDFUNCTIONS_DEPLOYEDFUNCTIONS_FAILED

function_slugstringrequired

Slug (identifier) of the Edge Function to update, e.g. 'hello-world'. Alphanumeric, underscores, and hyphens only.

refstringrequired

Project reference ID (20-character lowercase string). Found in the project's Supabase dashboard URL or via the List Projects tool.

bodystring

New Deno/TypeScript source code for the function. Leave blank to keep the current code.

namestring

New display name for the function. Leave blank to keep the current name.

verify_jwtboolean

Whether Supabase should verify a JWT on incoming requests to this function before invoking it. Leave blank to keep the current setting.

custom_hostnamestringrequired

The fully-qualified custom hostname to configure for this project, e.g. 'docs.example.com'. Maximum 253 characters.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

rolesarrayrequired

Array of role mapping objects to grant to user_id. Each object requires a role name and may include expires_at (unix timestamp, seconds), allowed_networks ({allowed_cidrs: [{cidr}], allowed_cidrs_v6: [{cidr}]}), and branches_only (boolean). Example: [{"role": "postgres", "expires_at": 1740787200, "allowed_networks": {"allowed_cidrs": [{"cidr": "203.0.113.0/24"}]}, "branches_only": false}]

user_idstringrequired

UUID of the user to update the JIT role mapping for.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

statestringrequired

Desired state of the JIT temporary access feature for this project.one of enableddisabled

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

dbAllowedCidrsarray

IPv4 CIDR ranges allowed to connect to the project's Postgres database. Example: ["203.0.113.0/24"]. Pass an empty array to remove all IPv4 restrictions (allow all).

dbAllowedCidrsV6array

IPv6 CIDR ranges allowed to connect to the project's Postgres database. Example: ["2001:db8::/32"]. Pass an empty array to remove all IPv6 restrictions (allow all).

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

root_keystringrequired

The new pgsodium root_key to set for the project, typically a base64-encoded string. Warning: changing this makes data encrypted with the previous key unreadable.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

default_pool_sizeinteger

Default number of database connections per pool, between 0 and 3000. Pass null or omit to leave unchanged.

pool_modestring

Dedicated pooler mode for the project: 'transaction' (connections returned to pool after each transaction) or 'session' (connection held for the client's whole session). Pass null or omit to leave unchanged.one of transactionsession

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

checkpoint_timeoutstring

Maximum time between automatic WAL checkpoints. Default unit: s. Optional — pass null or omit to leave the current value unchanged.

cron_log_statementboolean

Maps to the Postgres GUC 'cron.log_statement'. Controls whether pg_cron logs each job's SQL statement before executing it. Optional — pass null or omit to leave the current value unchanged.

effective_cache_sizestring

Planner's estimate of the effective size of the disk cache available to a single query (e.g. '4GB'). Accepts a size with unit. Optional — pass null or omit to leave the current value unchanged.

hot_standby_feedbackboolean

Sends feedback from a hot standby to prevent query conflicts on the primary. Optional — pass null or omit to leave the current value unchanged.

log_autovacuum_min_durationstring

Logs autovacuum activity that runs longer than this duration (e.g. '10s'). Default unit: ms. Optional — pass null or omit to leave the current value unchanged.

log_checkpointsboolean

Logs each checkpoint. Optional — pass null or omit to leave the current value unchanged.

log_connectionsboolean

Logs each successful connection. Optional — pass null or omit to leave the current value unchanged.

log_disconnectionsboolean

Logs the end of each session, including duration. Optional — pass null or omit to leave the current value unchanged.

log_durationboolean

Logs the duration of each completed statement. Optional — pass null or omit to leave the current value unchanged.

log_lock_waitsboolean

Logs long lock waits. Optional — pass null or omit to leave the current value unchanged.

log_recovery_conflict_waitsboolean

Logs recovery conflict waits longer than deadlock_timeout. Optional — pass null or omit to leave the current value unchanged.

log_replication_commandsboolean

Logs each replication command. Optional — pass null or omit to leave the current value unchanged.

log_startup_progress_intervalstring

Time between progress updates for long-running startup operations (e.g. '10s'). Default unit: ms. Optional — pass null or omit to leave the current value unchanged.

log_temp_filesstring

Logs the use of temporary files larger than this size. Optional — pass null or omit to leave the current value unchanged.

logical_decoding_work_memstring

Amount of memory used by logical decoding, before some data is written to local disk (e.g. '64MB'). Optional — pass null or omit to leave the current value unchanged.

maintenance_work_memstring

Maximum memory used for maintenance operations such as VACUUM and CREATE INDEX (e.g. '64MB'). Optional — pass null or omit to leave the current value unchanged.

max_connectionsinteger

Maximum number of concurrent database connections. Optional — pass null or omit to leave the current value unchanged.

max_locks_per_transactioninteger

Maximum number of locks per transaction. Optional — pass null or omit to leave the current value unchanged.

max_logical_replication_workersinteger

Maximum number of logical replication workers. Optional — pass null or omit to leave the current value unchanged.

max_parallel_maintenance_workersinteger

Maximum number of parallel workers for maintenance operations. Optional — pass null or omit to leave the current value unchanged.

max_parallel_workersinteger

Maximum number of workers for parallel operations. Optional — pass null or omit to leave the current value unchanged.

max_parallel_workers_per_gatherinteger

Maximum number of parallel workers per gather node. Optional — pass null or omit to leave the current value unchanged.

max_replication_slotsinteger

Maximum number of replication slots. Optional — pass null or omit to leave the current value unchanged.

max_slot_wal_keep_sizestring

Maximum WAL size retained by replication slots (e.g. '1GB'). Optional — pass null or omit to leave the current value unchanged.

max_standby_archive_delaystring

Maximum delay before canceling queries on a standby due to conflicts from archived WAL. Optional — pass null or omit to leave the current value unchanged.

max_standby_streaming_delaystring

Maximum delay before canceling queries on a standby due to conflicts from streamed WAL. Optional — pass null or omit to leave the current value unchanged.

max_sync_workers_per_subscriptioninteger

Maximum number of table synchronization workers per subscription. Optional — pass null or omit to leave the current value unchanged.

max_wal_sendersinteger

Maximum number of concurrent connections from standby servers or streaming backup clients. Optional — pass null or omit to leave the current value unchanged.

max_wal_sizestring

Maximum size WAL is allowed to grow to between automatic checkpoints (e.g. '1GB'). Optional — pass null or omit to leave the current value unchanged.

max_worker_processesinteger

Maximum number of background processes the system can support. Optional — pass null or omit to leave the current value unchanged.

restart_databaseboolean

Whether to restart the database immediately to apply configuration changes that require a restart. If false, such changes apply on the next scheduled restart. Optional — pass null or omit to leave the current value unchanged.

session_replication_rolestring

Controls firing of replication-related triggers and rules for the current session. Optional — pass null or omit to leave the current value unchanged.one of originreplicalocal

shared_buffersstring

Amount of memory used for shared memory buffers (e.g. '256MB'). Optional — pass null or omit to leave the current value unchanged.

statement_timeoutstring

Abort any statement that takes more than this duration. Default unit: ms. Optional — pass null or omit to leave the current value unchanged.

track_activity_query_sizestring

Size reserved for pg_stat_activity.query, in bytes (e.g. '1024'). Optional — pass null or omit to leave the current value unchanged.

track_commit_timestampboolean

Records commit time of transactions. Optional — pass null or omit to leave the current value unchanged.

wal_keep_sizestring

Minimum size of past WAL files retained for standby servers (e.g. '1GB'). Optional — pass null or omit to leave the current value unchanged.

wal_sender_timeoutstring

Terminate replication connections inactive for longer than this duration. Default unit: ms. Optional — pass null or omit to leave the current value unchanged.

work_memstring

Amount of memory used for query working space before writing to temporary disk files (e.g. '4MB'). Optional — pass null or omit to leave the current value unchanged.

refstringrequired

The project ref to update the PostgREST config for. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

db_extra_search_pathstring

Extra schemas to add to the search_path of every request, comma-separated.

db_poolinteger

Number of connections PostgREST keeps open to the database. Between 0 and 1000. If omitted, automatically configured based on compute size.

db_pool_acquisition_timeoutinteger

Seconds PostgREST waits to acquire a database connection before erroring. Between 0 and 60. If omitted, defaults to 10.

db_schemastring

Comma-separated list of schema(s) to expose via the Data API, e.g. 'public,storage'.

max_rowsinteger

Maximum number of rows returned from a view, table, or stored procedure. Between 0 and 1000000.

namestringrequired

New name for the project. Between 1 and 256 characters.

refstringrequired

The project ref to update. A 20-character lowercase string that uniquely identifies a Supabase project. Example: 'abcdefghijklmnopqrst'.

idstringrequired

The UUID of the API key to update.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

descriptionstring

New human-readable description for the API key. Pass null to clear an existing description.

namestring

New name for the API key. Must be 4-64 characters, lowercase letters/digits/underscores, starting with a letter or underscore (pattern ^[a-z_][a-z0-9_]+$).

revealboolean

Whether to reveal the actual secret value of the API key in the response. Defaults to false (redacted) when omitted.

secret_jwt_templateobject

Optional JWT template object controlling custom claims embedded when this key mints JWTs. Pass null to clear an existing template.

idstringrequired

UUID of the signing key to update.

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

statusstringrequired

New status for the signing key. One of: in_use, previously_used, revoked, standby. Example: standby.one of in_usepreviously_usedrevokedstandby

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

connection_poolinteger

Connection pool size for Realtime Authorization (1-100).

max_bytes_per_secondinteger

Maximum number of bytes per second per channel (1-10000000).

max_channels_per_clientinteger

Maximum number of channels per client (1-10000).

max_concurrent_usersinteger

Maximum number of concurrent users (1-50000).

max_events_per_secondinteger

Maximum number of events per second per channel (1-50000).

max_joins_per_secondinteger

Maximum number of channel joins per second (1-5000).

max_payload_size_in_kbinteger

Maximum payload size in KB (1-10000).

max_presence_events_per_secondinteger

Maximum number of presence events per second (1-5000).

presence_enabledboolean

Whether to enable presence.

private_onlyboolean

Whether to only allow private channels.

suspendboolean

Set to true to disable the Realtime service for this project; false to re-enable it.

databasebooleanrequired

Whether to enforce SSL for direct Postgres database connections. Set to true to require SSL; false to allow non-SSL connections.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

provider_idstringrequired

UUID of the SSO provider to update.

refstringrequired

Project reference ID (the 20-character lowercase project ref shown in the Supabase dashboard URL).

attribute_mappingobject

Object mapping SAML assertion attributes to Supabase user fields. Shape: {"keys": {"<field>": {"name": "<saml-attribute-name>", "names": ["alt-name"], "default": <value>, "array": false}}}. Example: {"keys": {"email": {"name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"}}}

domainsarray

Array of email domains that should be routed to this SSO provider. Example: ["acme.com", "contractors.acme.com"].

metadata_urlstring

URL where the SAML IdP metadata XML can be fetched. Example: https://sso.acme.com/metadata.xml. Provide either metadata_url or metadata_xml, not both.

metadata_xmlstring

Raw SAML IdP metadata XML content. Provide either metadata_xml or metadata_url, not both.

name_id_formatstring

SAML NameID format to use. One of the four standard SAML NameID format URNs. Example: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.one of urn:oasis:names:tc:SAML:1.1:nameid-format:unspecifiedurn:oasis:names:tc:SAML:2.0:nameid-format:transienturn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressurn:oasis:names:tc:SAML:2.0:nameid-format:persistent

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

fileSizeLimitinteger

Maximum upload file size in bytes, up to 536870912000 (500GB).

imageTransformationEnabledboolean

Whether image transformation is enabled.

purgeCacheEnabledboolean

Whether cache purging is enabled.

s3ProtocolEnabledboolean

Whether the S3-compatible protocol is enabled for this project's storage.

querystringrequired

The SQL statement(s) that make up this migration. Example: create table public.widgets(id bigint primary key);

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

idempotency_keystring

Optional value for the Idempotency-Key header, ensuring the same migration is tracked only once even if this request is retried.

namestring

Optional human-readable name for the migration entry, used to build the migration filename.

rollbackstring

Optional SQL statement(s) to roll back this migration. Example: drop table if exists public.widgets;

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

secret_namesarrayrequired

Array of secret names to permanently delete from the project. Example: ["OPENAI_API_KEY", "STRIPE_SECRET_KEY"]. Use the List Secrets tool first to confirm exact names.

slugstringrequired

Slug (identifier) of the organization claiming the project.

tokenstringrequired

The project claim token, obtained from Create Project Claim Token.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

branch_id_or_refstringrequired

The branch's project ref (20-character lowercase string) or the deprecated UUID branch ID.

forceboolean

Whether to delete the branch immediately (true, the default) or schedule deletion with a 1-hour grace period (false). Scheduled deletion is only available when soft deletion is enabled for the project.default true

function_slugstringrequired

Slug (identifier) of the Edge Function to delete, e.g. 'hello-world'. Alphanumeric characters, underscores, and hyphens only.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

remove_addonboolean

If true, also removes the custom domain add-on from the project's subscription in addition to clearing the hostname configuration. Defaults to false.default false

invite_idstringrequired

The UUID of the external JIT access invite to revoke and delete. Example: 55555555-5555-4555-8555-555555555555.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

user_idstringrequired

The UUID of the user whose JIT database access mappings should be revoked. Example: 55555555-5555-4555-8555-555555555555.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

ipv4_addressesarrayrequired

Array of IPv4 addresses to remove from the project's network ban list. Each address is unbanned immediately and can reconnect to the project right away. Example: ["203.0.113.10", "198.51.100.24"].

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

identifierstring

Optional free-form identifier for this unban request, used for audit/tracking purposes on Supabase's side. Not required for the operation to succeed.

requester_ipboolean

Whether to also include the requester's own public IP address (the caller of this API) in the list of addresses to unban. Defaults to false.default false

refstringrequired

The 20-character project reference ID (lowercase letters only) of the project to permanently delete. Found in the project's Supabase dashboard URL or Settings > General.

idstringrequired

The UUID of the API key to permanently delete.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

reasonstring

Optional free-form reason describing why this API key is being deleted, recorded for audit purposes.

revealboolean

Whether to include the actual secret value of the deleted API key in the response. Defaults to false (redacted) when omitted.

was_compromisedboolean

Whether this key is being deleted because it was compromised (leaked, exposed publicly, etc). Defaults to false when omitted.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

tpa_idstringrequired

UUID of the third-party auth integration to remove. Obtain it from the list of configured TPA integrations for the project.

provider_idstringrequired

UUID of the SSO provider to remove. Obtain it from the list of configured SSO providers for the project.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

branch_id_or_refstringrequired

The branch's project ref (20-character lowercase string) or the deprecated UUID branch ID.

migration_versionstring

Optional migration version timestamp (e.g. '20250312000000') to merge up to. If omitted, all pending migrations on the branch are merged into the parent branch.

refstringrequired

The 20-character project reference ID (lowercase letters only) of the project to pause. Found in the project's Supabase dashboard URL or Settings > General.

branch_id_or_refstringrequired

The branch's project ref (20-character lowercase string) or the deprecated UUID branch ID.

migration_versionstring

Optional migration version timestamp (e.g. '20250312000000') to push up to. If omitted, all pending migrations from the parent branch are pushed to this branch.

addon_variantstringrequired

The addon variant to remove. Compute addons (ci_micro..ci_48xlarge_high_memory) revert the project's compute instance to its previous size. cd_default removes the custom domain addon. pitr_7/pitr_14/pitr_28 disable point-in-time-recovery at that retention window. ipv4_default releases the dedicated IPv4 address. Example: pitr_7.one of ci_microci_smallci_mediumci_largeci_xlargeci_2xlargeci_4xlargeci_8xlargeci_12xlargeci_16xlargeci_24xlargeci_24xlarge_optimized_cpuci_24xlarge_optimized_memoryci_24xlarge_high_memoryci_48xlargeci_48xlarge_optimized_cpuci_48xlarge_optimized_memoryci_48xlarge_high_memorycd_defaultpitr_7pitr_14pitr_28ipv4_default

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

idstringrequired

UUID of the signing key to remove. The key must currently be in revoked status. Obtain it from the list of the project's Auth signing keys.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

database_identifierstringrequired

Identifier of the read replica database to remove.

refstringrequired

The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.

branch_id_or_refstringrequired

The branch's project ref (20-character lowercase string) or the deprecated UUID branch ID.

migration_versionstring

Optional migration version timestamp (e.g. '20250312000000') to reset up to. If omitted, all migrations are replayed from scratch.

refstringrequired

The 20-character project reference ID (lowercase letters only) of the project to restart. Found in the project's Supabase dashboard URL or Settings > General.

idintegerrequired

The numeric ID of the physical backup to restore, as returned by the project's backups listing. Example: 12345.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

recovery_time_target_unixintegerrequired

The target recovery time as a Unix timestamp (seconds since epoch). The database is restored to its state at this exact point in time. Must fall within the project's PITR retention window. Example: 1740787200 (2025-03-01T00:00:00Z).

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.

refstringrequired

The 20-character project reference ID (lowercase letters only) of the paused project to restore. Found in the project's Supabase dashboard URL or Settings > General.

gtestringrequired

Roll back all migrations with a version number greater than or equal to this value. Migration versions are typically timestamps formatted as YYYYMMDDHHMMSS. Example: 20250312000000.

refstringrequired

The 20-character lowercase Supabase project reference ID. Found in the project's dashboard URL or via the List Projects tool. Example: abcdefghijklmnopqrst.