Skip to main content
Connect your Supabase account to let CloudThinker agents view projects, databases, schemas, migrations, branches, logs, and generated types, and investigate application data and delivery issues from one place. Supabase uses OAuth, so you do not need to create a Supabase access token or paste credentials into CloudThinker. Database and project changes stay deliberate actions that wait for your approval.

​
Prerequisites

  • A Supabase account with access to the projects you want CloudThinker to inspect.
  • Permission to authorize CloudThinker through Supabase’s OAuth flow.

​
Setup

1

Open CloudThinker

Navigate to Connections → Supabase in your CloudThinker workspace.
2

Start the OAuth flow

Click Connect to open Supabase’s authorization page.
3

Authorize CloudThinker

Sign in to the Supabase account that owns or can access the projects you want agents to use, then approve access.
4

Return to CloudThinker

After authorization, CloudThinker stores the OAuth tokens and shows a Connected status.

​
Connection details

Supabase uses OAuth — there are no connection fields to enter manually.

​
Required permissions

CloudThinker inherits the Supabase access granted during OAuth.
  • Read operations include listing projects, reviewing schemas, migrations, branches, logs, and generated types.
  • Changes to a database or project remain deliberate actions gated by approval in CloudThinker.

​
Agent capabilities

Once connected, agents can:

​
Verify the connection

​
Example prompts

​
Troubleshooting

Your browser may be signed in to the wrong Supabase account, or not signed in at all. Sign in to the intended account and retry the connection flow from Connections → Supabase.
The OAuth flow was completed with a Supabase account that lacks access to those projects. Reconnect using the account that owns or has access to them.
The authorization may have been revoked in Supabase. Remove the connection in CloudThinker and run the OAuth flow again.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Approval for changes — database and project changes wait for explicit approval in CloudThinker.
  • Scope by account — the connection sees exactly what the authorizing Supabase account sees.

Neon Connection

OAuth-connected serverless Postgres

PostgreSQL Connection

Direct Postgres analysis and tuning