Supabase CLI link fails - Management API /api-keys returns 404 Not Found

[bharanithachar-dev]

Hi Supabase team/community,

I am unable to link my local Supabase project using the Supabase CLI.

Environment:

• OS: Windows 11
• Supabase CLI: 2.117.0
• Project is active and Healthy in the Supabase Dashboard
• CLI login completes successfully
• The project appears when I run supabase projects list

When I run:

npx.cmd supabase link --project-ref <PROJECT_REF>

I receive:

Authorization failed for the access token and project ref pair:
{"message":"Not Found"}

I also tested:

npx.cmd supabase projects api-keys --project-ref <PROJECT_REF>

and receive:

unexpected get api keys status 404:
{"message":"Not Found"}

Running supabase link --debug shows that the CLI successfully calls:

GET /v1/projects/<PROJECT_REF>

but the request to:

GET /v1/projects/<PROJECT_REF>/api-keys

returns 404 Not Found.

Important details:

• The same project is visible and accessible in my Supabase Dashboard.
• The project status is Healthy.
• API keys are visible in Dashboard > Settings > API Keys.
• I logged out/in and generated a fresh CLI access token.
• The issue still occurs with Supabase CLI 2.117.0.
• I can access both the new Publishable/Secret API Keys and the Legacy anon/service_role API Keys in the dashboard.

Could you please confirm whether this is a Management API / CLI compatibility issue related to the newer API key system, or advise how I can successfully link this project?

My immediate goal is to link the existing project and safely apply my pending database migrations.

For security, I have intentionally not included any access tokens, API keys, database passwords, or service-role keys.

Thank you.

[k1ng-arthur]

Is the project ref definitely being spelled correctly? I've seen this issue before when that has a letter missing or transposed with another letter

[somuai]

Here is why this error occurs and how to immediately unblock applying your database migrations.

---

Why GET /v1/projects/<ref>/api-keys returns 404

In the Supabase CLI (supabase link), the linking workflow executes two sequential Management API calls:

1. GET /v1/projects/<ref>: Fetches general project status and PostgreSQL image version.
2. GET /v1/projects/<ref>/api-keys?reveal=true: Resolves the anon and service_role keys to configure local service bindings.

When step 2 returns a non-200 status (including 404), the CLI formats it as:
Authorization failed for the access token and project ref pair: {"message":"Not Found"}

This 404 on /api-keys typically happens in two scenarios:

1. Organization Role / Token Permissions: Viewing or revealing service-role API keys requires Owner or Admin privileges. If your account has the Developer or Read-Only role in the organization, or if your Personal Access Token (PAT) was generated with restricted resource scopes, the Management API returns 404 Not Found (used by the API to prevent leaking resource existence).
2. New Publishable/Secret Keys Rollout: On newer projects using the publishable key architecture (sb_pub_...), the legacy /api-keys endpoint does not find legacy JWT keys populated.

---

How to Unblock Your Migrations Immediately

You do not need supabase link to apply pending database migrations. Here are the two fastest ways to apply them right away:

Option 1: Direct Database Push via --db-url (Recommended)

You can run db push directly against your remote database connection string. This completely bypasses the Management API:

# Using the connection pooler (Session pooler on port 5432 or Transaction pooler on 6543)
npx supabase db push --db-url "postgresql://postgres.[PROJECT_REF]:[YOUR_PASSWORD]@aws-0-[REGION].pooler.supabase.com:6543/postgres"

You can copy the exact URI from your Dashboard under Project Settings > Database > Connection string > URI.

Option 2: Manual Project Link via .temp/project-ref

Under the hood, supabase link simply writes your project reference to the local .temp directory. You can create this file manually:

On Windows (PowerShell):

New-Item -ItemType Directory -Force -Path "supabase/.temp"
Set-Content -Path "supabase/.temp/project-ref" -Value "<PROJECT_REF>"

On bash / zsh:

mkdir -p supabase/.temp
echo "<PROJECT_REF>" > supabase/.temp/project-ref

Once this file exists, the CLI recognizes the project as linked, and subsequent commands like supabase db push will prompt for your database password instead of querying the /api-keys endpoint.

---

Fixing the Management API / Link Command

If you want supabase link to work out-of-the-box:

1. Verify that your Supabase organization role is Owner or Admin under Organization Settings > Team.
2. Generate a new Personal Access Token from Account > Access Tokens ensuring it has full account permissions, then run:

   npx supabase logout
   npx supabase login