KeyKeeperSupabase Management API
How an agent gets a Supabase Management API key through KeyKeeper, what to choose on supabase.com, and how KeyKeeper verifies it.
| Template id | supabase (also supabase-cli, supabase-access-token) |
|---|---|
| Field | supabase-access-token → SUPABASE_ACCESS_TOKEN · secret |
| Key looks like | starts with sbp_, shown once when created |
| Created at | supabase.com |
| Verified by KeyKeeper | GET https://api.supabase.com/v1/projects — lists the projects this token can see |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show supabase
keykeeper save --provider supabase --from-clipboard --create --purpose "what this task does"
keykeeper run -c supabase -- <your command>--provider supabase fills in the credential id and the field. The environment
variable is the one Supabase Management API's own tools read, so nothing has to be mapped.
What only you can do
Log in to supabase.com
Name the token
Pick an expiry
Copy the key, then approve the save in KeyKeeper's window.
What to choose
This is a Management API personal access token, not a database/runtime key. Prefer a scoped PAT limited to one project and only the permissions needed; classic PATs inherit the account's broad access.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Supabase Management API key (starts with
sbp_, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: KeyKeeper itself sends
GET https://api.supabase.com/v1/projectswith the key in theAuthorizationheader (lists the projects this token can see). The agent receives accepted, rejected or could not reach — never the value.
Rotation and expiry
Set the Management API token's expiry when creating it and record that date here. Rotate or revoke at supabase.com.