password authentication failed for user \"supabase_auth_admin\" (SQLSTATE 28P01))

[wihelmi]

Docker failed with error:
{"level":"fatal","msg":"running db migrations: Migrator: problem creating schema
migrations: couldn't start a new transaction: could not create new transaction:
failed to connect to host=db user=supabase_auth_admin database=postgres: fail
ed SASL auth (FATAL: password authentication failed for user "supabase_auth_adm
in" (SQLSTATE 28P01))","time":"2026-07-14T18:08:09Z"}

My dockers:
gotrue:v2.192.0 kong:2.8.1 postgres-meta:v0.96.6 postgres:17.6.1.140 postgrest:v14.14 studio:2026.06.29-sha-20290c7 supavisor:2.9.5

I started Docker using the official configuration file. Thanx

[Baek-Seunghyun]

This is the classic self-hosted gotcha: POSTGRES_PASSWORD is only applied to the internal database roles when the database volume is first initialized. If you changed the password in .env after the first docker compose up (or reused an old volumes/db/data directory from a previous attempt), the running database still has the old passwords for roles like supabase_auth_admin — while gotrue reads the new value from .env and fails with exactly this 28P01.

Two ways out:

A. Fresh install / no data to keep (fastest):

docker compose down -v
rm -rf volumes/db/data
docker compose up -d

The init scripts re-run and every internal role gets the current POSTGRES_PASSWORD.

B. Keep existing data — realign the role passwords manually:

docker exec -it supabase-db psql -U supabase_admin -d postgres

ALTER USER supabase_auth_admin WITH PASSWORD 'your-current-POSTGRES_PASSWORD';
ALTER USER supabase_storage_admin WITH PASSWORD 'your-current-POSTGRES_PASSWORD';
ALTER USER authenticator WITH PASSWORD 'your-current-POSTGRES_PASSWORD';
ALTER USER supabase_functions_admin WITH PASSWORD 'your-current-POSTGRES_PASSWORD';
ALTER USER pgbouncer WITH PASSWORD 'your-current-POSTGRES_PASSWORD';

(Then restart the stack. supabase_auth_admin fixes gotrue specifically; the others prevent the same error from storage/rest/pooler next.)

One more thing worth checking: if your password contains characters that are special in a connection URI (@, :, /, %, #), gotrue's DATABASE_URL parsing can also fail this way even with the "right" password — sticking to long alphanumeric passwords avoids that whole class of problem.

Docs: https://supabase.com/docs/guides/self-hosting/docker (see the notes about setting secrets before the first start).

[wihelmi]

Thank u for your help. I solved this problem by running db-passwd.sh.

[aantti]

Good to hear, indeed - https://supabase.com/docs/guides/self-hosting/docker#changing-database-password