> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Supabase

> Connect Supabase to CloudThinker for project discovery, schema review, migration and branch inspection, and log investigation

Connect your Supabase account to let CloudThinker agents view projects, databases, schemas, migrations, branches, logs, and generated types, and investigate application data and delivery issues from one place.

Supabase uses **OAuth**, so you do not need to create a Supabase access token or paste credentials into CloudThinker. Database and project changes stay deliberate actions that wait for your [approval](/guide/approval).

## Prerequisites

* A **Supabase account** with access to the projects you want CloudThinker to inspect.
* Permission to authorize CloudThinker through Supabase's OAuth flow.

## Setup

<Steps>
  <Step title="Open CloudThinker">
    Navigate to **Connections → Supabase** in your CloudThinker workspace.
  </Step>

  <Step title="Start the OAuth flow">
    Click **Connect** to open Supabase's authorization page.
  </Step>

  <Step title="Authorize CloudThinker">
    Sign in to the Supabase account that owns or can access the projects you want agents to use, then approve access.
  </Step>

  <Step title="Return to CloudThinker">
    After authorization, CloudThinker stores the OAuth tokens and shows a **Connected** status.
  </Step>
</Steps>

## Connection details

Supabase uses OAuth — there are no connection fields to enter manually.

| Field            | Description                                                           |
| ---------------- | --------------------------------------------------------------------- |
| **OAuth tokens** | Issued by Supabase and stored automatically; no manual entry required |

## Required permissions

CloudThinker inherits the Supabase access granted during OAuth.

* **Read operations** include listing projects, reviewing schemas, migrations, branches, logs, and generated types.
* **Changes** to a database or project remain deliberate actions gated by [approval](/guide/approval) in CloudThinker.

## Agent capabilities

Once connected, agents can:

| Capability                          | Description                                                  |
| ----------------------------------- | ------------------------------------------------------------ |
| **Project discovery**               | List projects and their databases                            |
| **Schema review**                   | Inspect schemas and generated types                          |
| **Migration and branch inspection** | Review migrations and branches to see what changed and where |
| **Log investigation**               | Read project logs to trace application and delivery issues   |

### Verify the connection

```text theme={null}
@tony list my Supabase projects and summarize their schemas
```

### Example prompts

```text theme={null}
@tony #report what changed this week in the migrations on the production Supabase project
@tony #report the errors in my Supabase project logs over the last 24 hours
@tony #recommend what to reconcile between the staging branch schema and production
```

## Troubleshooting

<Accordion title="OAuth flow does not complete">
  Your browser may be signed in to the wrong Supabase account, or not signed in at all. Sign in to the intended account and retry the connection flow from **Connections → Supabase**.
</Accordion>

<Accordion title="Agent cannot find expected projects">
  The OAuth flow was completed with a Supabase account that lacks access to those projects. Reconnect using the account that owns or has access to them.
</Accordion>

<Accordion title="Connection worked, then stopped">
  The authorization may have been revoked in Supabase. Remove the connection in CloudThinker and run the OAuth flow again.
</Accordion>

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Approval for changes** — database and project changes wait for explicit approval in CloudThinker.
- **Scope by account** — the connection sees exactly what the authorizing Supabase account sees.

## Related

<CardGroup cols={2}>
  <Card title="Neon Connection" icon="https://mintcdn.com/cloudthinker/CGWam0VVP8R5KVLk/images/icons/neon.svg?fit=max&auto=format&n=CGWam0VVP8R5KVLk&q=85&s=b05ce5f301da12a6b985ad05ea21a455" href="/guide/connections/neon" width="24" height="24" data-path="images/icons/neon.svg">
    OAuth-connected serverless Postgres
  </Card>

  <Card title="PostgreSQL Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/postgresql.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=8bb2ac033d0a2ccbef51154a76e1e819" href="/guide/connections/postgresql" width="24" height="24" data-path="images/icons/postgresql.svg">
    Direct Postgres analysis and tuning
  </Card>
</CardGroup>