Repository navigation
Scoped tokens: supabase link needs API Key Secrets even though db push only needs the DB password #7165
Description
Affected area
Auth
Supabase CLI version
2.108.0
Operating system
Ubuntu 24.04 (GitHub Actions ubuntu-latest); also reproduced on Windows 11
Installation method
None
Command
SUPABASE_ACCESS_TOKEN=<project-scoped PAT> supabase link --project-ref <ref> --debugActual output
Using access token from env var...
Supabase CLI 2.120.0
HTTP GET: https://api.supabase.com/v1/projects/<ref>
HTTP GET: https://api.supabase.com/v1/projects/<ref>/api-keys
Authorization failed for the access token and project ref pair: {"message":"Your account does not have the necessary privileges to access this endpoint. For more details, refer to our documentation https://supabase.com/docs/guides/platform/access-control"}Expected behavior
supabase link (followed by supabase db push) works with a project-scoped token that has Migrations read-write and project/database read, without needing API Key Secrets. db push uses the database password and never needs the secret service_role key, so link shouldn't fetch secret keys, or should skip them when the token lacks API Key Secrets. If a permission is missing, the 403 should name it in missing_permissions, as the docs say.
Steps to reproduce
- Create a scoped personal access token (resource access: one project) with: Migrations read-write; Project Settings, Database, Database Config, Connection Pooling, API Keys read. Created by the organization Owner.
- Run: SUPABASE_ACCESS_TOKEN= supabase link --project-ref --debug
- It fails on GET /v1/projects//api-keys with "Your account does not have the necessary privileges to access this endpoint".
- Add API Key Secrets: read to a new token → link succeeds.
Workaround: supabase db push --db-url (no link, no token).
Crash report ID
No response
Docker and service versions
Additional context
No response
Activity
feat(evals): add deploy-cli-001-login-and-link CLI eval (CLI-2706) (#413
drunkeninja42 commentedon Oct 24, 2026
I looked into the link code for this. The same bug is tracked in #6392, which is assigned to @7ttp. Are you already working on it? If so, no worries, I'll leave it. If not, I'd like to pick it up.
The 403 comes from the
reveal=truerequest here:cli/apps/cli/src/commands/link/link.handler.ts
Lines 433 to 440 in 4664850
As tested in #6392, the plain
/api-keysrequest returns 200 with the same token; onlyreveal=trueis refused. The secret key is only used for the optional version checks inlinkServicesCore, which already skip silently on failure, andbootstrapruns those checks with the anon key:cli/apps/cli/src/command-internal/link-services-core.ts
Lines 26 to 29 in 4664850
So my idea:
reveal=truecomes back 403, request the keys again withoutrevealI'd add integration tests for the 403 fallback and the 401 case, and update
link/SIDE_EFFECTS.md. If that works for you, it would need theopen-for-contributionlabel.Spiatron commentedon Oct 24, 2026
@drunkeninja42 thanks for digging into this, your analysis matches what we saw. With a project-scoped token (Migrations read-write; Project Settings, Database and API Keys read), link fails on the api-keys call, and adding API Key Secrets read fixes it. Your fallback would solve it for us.
Happy to help: once there's a PR I can test its build against our setup (scoped token, no API Key Secrets) and confirm link + db push work. And if neither of you ends up taking it, I'd be glad to pick it up.
Fine to close this one as a duplicate of #6392 if that's easier to track.
drunkeninja42 commentedon Oct 24, 2026
Thanks @Spiatron, good to have it confirmed. I'll hold until @7ttp or a maintainer weighs in, and I'll ping you for testing if I end up opening the PR.