You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Until now, a personal access token could do anything your account could do, across every organization and project. Starting August 10, 2026, we're rolling out scoped PATs to a small group of users, so you can limit a token to the resources and permissions it actually needs. If you don't see the new form yet, you will as the rollout expands.
What's new
When you generate a token from your account's access tokens page, you can now choose:
Resource access: limit the token to selected projects in a single organization, or to all projects in selected organizations.
Permission scopes: grant read or read-write access per capability (projects, database, auth, storage, and so on) instead of everything your account can do.
Expiry: pick a preset or a custom date up to one year out.
Before the token is created, a review step shows the access you're granting and an overall risk level. A token's access can't be changed after creation. To change it, delete the token and create a new one.
Known limitation: Supabase MCP server
Scoped tokens don't work with the Supabase MCP server yet, though that support is on the way. If you need MCP server access today, create a legacy (account-level) token.
Account-level tokens still work
You can still create a full account-level PAT via "Create legacy token", but we recommend against it. A token limited to the projects and permissions it actually needs is a much smaller blast radius if it ever leaks.
Existing tokens are not affected
Every existing token keeps working until it expires or you delete it. Nothing is being revoked and there's nothing you need to do right now, though once scoped PATs reach you, it's worth swapping your old tokens for scoped ones.
We'd love feedback from alpha users, especially on permission scopes you're missing or workflows the new form doesn't cover. Drop a comment below.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Supabase
Uh oh!
There was an error while loading. Please reload this page.
Until now, a personal access token could do anything your account could do, across every organization and project. Starting August 10, 2026, we're rolling out scoped PATs to a small group of users, so you can limit a token to the resources and permissions it actually needs. If you don't see the new form yet, you will as the rollout expands.
What's new
When you generate a token from your account's access tokens page, you can now choose:
Before the token is created, a review step shows the access you're granting and an overall risk level. A token's access can't be changed after creation. To change it, delete the token and create a new one.
Known limitation: Supabase MCP server
Scoped tokens don't work with the Supabase MCP server yet, though that support is on the way. If you need MCP server access today, create a legacy (account-level) token.
Account-level tokens still work
You can still create a full account-level PAT via "Create legacy token", but we recommend against it. A token limited to the projects and permissions it actually needs is a much smaller blast radius if it ever leaks.
Existing tokens are not affected
Every existing token keeps working until it expires or you delete it. Nothing is being revoked and there's nothing you need to do right now, though once scoped PATs reach you, it's worth swapping your old tokens for scoped ones.
We'd love feedback from alpha users, especially on permission scopes you're missing or workflows the new form doesn't cover. Drop a comment below.
All reactions