Supabase Management API

Overview

Use a Supabase personal access token to call the account-level Management API at api.supabase.com. Alter sends the token as Authorization: Bearer ... and validates it when the secret is saved.

Property	Value
Provider ID	supabase-management
Category	Developer Tools
Credential Type	Bearer Token

Note

This template is for account-level management. To call Data, Auth, Storage, Functions, Realtime, or GraphQL on a project host, use Supabase Project APIs.

Step 1: Get Credentials

Open Account settings → Access Tokens, generate a token, and copy the personal access token beginning with sbp_.

Step 2: Add to Alter Vault

Choose Managed Secrets → Add Managed Secret → Supabase Management API, paste the personal access token, and save. Alter validates it against the Management API and fixes the proxy destination to api.supabase.com.

The Management API destination is provider-owned. It cannot be widened or cleared with the generic allowed-hosts editor or CLI command.

Credential rotation reapplies the built-in bearer-header and api.supabase.com binding. A project API key is rejected rather than being stored under the Management API contract.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://api.supabase.com/v1/projects",
    grant_id="YOUR_GRANT_ID",
)

Policy-cataloged operations

Alter policy rules can target the Management API’s attested operations, including project and organization creation, branch management, billing add-ons, API-key administration, secrets, functions, and JIT database access.

Example operation ID	Families	Method	Provider path
v1-create-a-project	write	POST	/v1/projects
v1-delete-a-project	delete	DELETE	/v1/projects/{ref}
v1-apply-project-addon	payment	PATCH	/v1/projects/{ref}/billing/addons
v1-invite-external-jit-access	admin, send	POST	/v1/projects/{ref}/database/jit/invite
v1-create-project-api-key	admin, write	POST	/v1/projects/{ref}/api-keys