Supabase Integration: Database & Auth for Agents

Agents can manage Supabase projects, databases, edge functions, and storage. OAuth credentials are injected automatically.

Overview

OneCLI connects AI agents to Supabase through OAuth. Agents can manage projects, run database queries, view edge functions, manage storage buckets, and access auth configuration. The gateway injects OAuth credentials into requests to the Supabase Management API automatically.

Setup

1. Go to Connections

   Open the OneCLI dashboard and navigate to Connections > Supabase.

2. Authorize

   Click Connect Supabase. You’ll be redirected to Supabase to authorize OneCLI. Review the permissions and click Authorize.

3. Verify

   After authorization, you’ll be redirected back to the dashboard. The connection will show as Connected with your Supabase organization name.

What agents can do

Area	Description
Projects	View projects, settings, and network configuration
Database (read)	Read database config, connection pooler, and SSL settings
Database (write)	Run SQL queries, manage webhooks, and backups
Auth	View auth configuration and SSO providers
Organizations	View organization metadata and members
Storage	List and view storage buckets
Edge Functions	List and view edge functions
Secrets	View API keys and project secrets

Use cases

• Database management agents that run SQL queries and manage schemas
• Infrastructure agents that provision and configure Supabase projects
• Monitoring agents that check database health and connection pool status
• Agents that manage storage buckets and edge function deployments

Self-hosted setup

For self-hosted deployments, configure your own Supabase OAuth app:

1. Create an OAuth app in your Supabase organization settings
2. Set the environment variables SUPABASE_CLIENT_ID and SUPABASE_CLIENT_SECRET

Controlling access with rules

Use OneCLI’s rules engine to restrict what agents can do. For example, allow read-only access to projects without granting database write or allow SQL reads but block destructive queries. Rules are evaluated before credential injection.