# Personal Access Tokens Scope personal access tokens to specific organizations, projects, and permissions Personal access tokens (PATs) authenticate you to the [Management API](/docs/reference/api/introduction) and the tools built on it, like the Supabase CLI and the [MCP server](/docs/guides/ai-tools/mcp). They come in two flavors: - **Classic tokens**, shown with a **Legacy** badge in the dashboard, carry your account's full access. That means every permission, on every organization and every project you belong to today, and on every one you create or join in the future. A classic token created a year ago can touch a project you created today. - **Scoped tokens** carry only the organizations, projects, and permissions you choose. For example: read one project's database and view its logs, with no access to billing or organization settings. Note: We recommend scoped tokens for everything, especially AI agents, automation scripts, and CI environments. If a token leaks, the blast radius stays small. To use scoped personal access tokens you need a Supabase account with a role on the organization or project you want the token to reach. A scoped personal access token's permissions only ever narrow what your account can already do. They never grant more. If your role doesn't include a permission (see [Access Control](/docs/guides/platform/access-control)), granting that permission to a token has no effect: the token still can't do it. You create scoped tokens the same way as classic tokens, from your [access tokens](/dashboard/account/tokens) settings. Choose which permissions to grant during creation instead of leaving the token with full access. ## Create and use a scoped personal access token This example creates a token that can only read one project's settings, then calls an endpoint outside that scope. Both calls are reads available to every organization role, including Read-Only, so anyone can run it. 1. Go to your [access tokens](/dashboard/account/tokens) settings and generate a new token. 2. While creating it, scope the token to one project and grant only the **Project Settings** permission with **Read** access. 3. Copy the token (scoped personal access tokens start with `sbp_fc`) and use it against the Management API, replacing `your-project-ref` with the project's ref: ```bash export SUPABASE_ACCESS_TOKEN="sbp_fc..." # Allowed: Project Settings Read unlocks this endpoint curl "https://api.supabase.com/v1/projects/your-project-ref" \ -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" # Returns the project's details # Denied: this endpoint needs the Database permission, which the token lacks curl -i "https://api.supabase.com/v1/projects/your-project-ref/types/typescript" \ -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" # Returns HTTP 403 ``` To grant exactly what a workflow needs, see [Permission scopes](#permission-scopes) for the permission each endpoint requires and [MCP tools](#mcp-tools) for the permission each MCP tool requires. ## Use a scoped personal access token with the Supabase CLI The browser flow of `supabase login` creates a classic token. To run the CLI with a scoped token instead, set it in the `SUPABASE_ACCESS_TOKEN` environment variable, or save it with `supabase login --token`. The environment variable takes precedence over any saved token, which also makes it the right choice for CI. For example, with a token granted **Projects (account-wide)** with **Read** access, `supabase projects list` lists the projects the token can reach: ```bash export SUPABASE_ACCESS_TOKEN="sbp_fc..." supabase projects list ``` Commands that call the Management API fail with a permission error when the token lacks the required permission. `supabase link`, for instance, needs **Project Settings**, **API Keys**, and **API Key Secrets**, all with **Read** access. Database commands that connect with your database password, such as `supabase db push` with `SUPABASE_DB_PASSWORD` set, aren't limited by the token's permissions. A workflow that runs `supabase link` before `supabase db push` still needs the permissions `supabase link` requires. ## Permission scopes Each permission controls read or read-write access to one resource, for example **Database**, **Edge Functions**, or **Production Branches**. The permissions and names below match those shown when creating a scoped personal access token. Permissions that currently unlock neither a public Management API endpoint nor an MCP tool are omitted. A few endpoints need more than one permission. The footnotes call these out. | Permission | Access required | Management API endpoint | | -------------------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | **Project** | | | | Project Settings | Read | [Get JIT access config](/docs/reference/api/v1-get-jit-access-config) | | | | [Get postgres upgrade eligibility](/docs/reference/api/v1-get-postgres-upgrade-eligibility)[^1] | | | | [Get postgres upgrade status](/docs/reference/api/v1-get-postgres-upgrade-status)[^1] | | | | [Get project](/docs/reference/api/v1-get-project) | | | | [Get services health](/docs/reference/api/v1-get-services-health) | | | | [List available restore versions](/docs/reference/api/v1-list-available-restore-versions) | | | | [List private link associations](/docs/reference/api/v2-list-private-link-associations) | | | | [Preview a project transfer](/docs/reference/api/v2-preview-a-project-transfer) | | | Read-write | [Cancel a project restoration](/docs/reference/api/v1-cancel-a-project-restoration) | | | | [Create private link association](/docs/reference/api/v2-create-private-link-association) | | | | [Delete a project](/docs/reference/api/v1-delete-a-project) | | | | [Delete private link association](/docs/reference/api/v2-delete-private-link-association) | | | | [Delete private link association for database](/docs/reference/api/v2-delete-private-link-association-for-database) | | | | [Get pgsodium config](/docs/reference/api/v1-get-pgsodium-config) | | | | [OAuth authorize project claim](/docs/reference/api/v1-oauth-authorize-project-claim)[^2] | | | | [Pause a project](/docs/reference/api/v1-pause-a-project) | | | | [Restart a project](/docs/reference/api/v1-restart-a-project) | | | | [Restore a project](/docs/reference/api/v1-restore-a-project) | | | | [Update a project](/docs/reference/api/v1-update-a-project) | | | | [Update auth service config](/docs/reference/api/v1-update-auth-service-config)[^3] | | | | [Update JIT access config](/docs/reference/api/v1-update-jit-access-config) | | | | [Update pgsodium config](/docs/reference/api/v1-update-pgsodium-config) | | | | [Upgrade postgres version](/docs/reference/api/v1-upgrade-postgres-version)[^4] | | Action Runs | Read | [Count action runs](/docs/reference/api/v1-count-action-runs) | | | | [Get action run](/docs/reference/api/v1-get-action-run) | | | | [Get action run logs](/docs/reference/api/v1-get-action-run-logs) | | | | [List action runs](/docs/reference/api/v1-list-action-runs) | | | Read-write | [Update action run status](/docs/reference/api/v1-update-action-run-status) | | Advisors | Read | [Get performance advisors](/docs/reference/api/v1-get-performance-advisors) | | | | [Get security advisors](/docs/reference/api/v1-get-security-advisors) | | | | [Run project advisors](/docs/reference/api/v2-run-project-advisors) | | Analytics Config | Read | [List log drains](/docs/reference/api/v2-list-log-drains) | | | Read-write | [Create log drain](/docs/reference/api/v2-create-log-drain) | | | | [Delete log drain](/docs/reference/api/v2-delete-log-drain) | | | | [Update log drain](/docs/reference/api/v2-update-log-drain) | | Logs | Read | [Get project logs](/docs/reference/api/v1-get-project-logs) | | | | [Get project logs all](/docs/reference/api/v1-get-project-logs-all) | | | | [Scrape project metrics](/docs/reference/api/v1-scrape-project-metrics) | | Usage Analytics | Read | [Get project function combined stats](/docs/reference/api/v1-get-project-function-combined-stats) | | | | [Get project usage API count](/docs/reference/api/v1-get-project-usage-api-count) | | | | [Get project usage request count](/docs/reference/api/v1-get-project-usage-request-count) | | Platform Webhooks | Read | [Get delivery](/docs/reference/api/v2-projects-ref-webhooks-deliveries-id-get) | | | | [Get endpoint](/docs/reference/api/v2-projects-ref-webhooks-endpoints-id-get) | | | | [List deliveries](/docs/reference/api/v2-projects-ref-webhooks-endpoints-id-deliveries-get) | | | | [List endpoints](/docs/reference/api/v2-projects-ref-webhooks-endpoints-get) | | | Read-write | [Create endpoint](/docs/reference/api/v2-projects-ref-webhooks-endpoints-post) | | | | [Delete all endpoints](/docs/reference/api/v2-projects-ref-webhooks-endpoints-delete) | | | | [Delete endpoint](/docs/reference/api/v2-projects-ref-webhooks-endpoints-id-delete) | | | | [Retry delivery](/docs/reference/api/v2-projects-ref-webhooks-deliveries-id-retry-post) | | | | [Send test event](/docs/reference/api/v2-projects-ref-webhooks-endpoints-id-test-post) | | | | [Update endpoint](/docs/reference/api/v2-projects-ref-webhooks-endpoints-id-patch) | | Notebooks | Read | [Get notebook](/docs/reference/api/v2-get-notebook) | | | | [List notebooks](/docs/reference/api/v2-list-notebooks) | | | Read-write | [Create notebook](/docs/reference/api/v2-create-notebook) | | | | [Delete notebook](/docs/reference/api/v2-delete-notebook) | | | | [Update notebook](/docs/reference/api/v2-update-notebook) | | **Database** | | | | Backups | Read | [Get backup schedule](/docs/reference/api/v1-get-backup-schedule) | | | | [List all backups](/docs/reference/api/v1-list-all-backups) | | | Read-write | [Restore PITR backup](/docs/reference/api/v1-restore-pitr-backup) | | | | [Update backup schedule](/docs/reference/api/v1-update-backup-schedule) | | Database | Read | [Generate typescript types](/docs/reference/api/v1-generate-typescript-types) | | | | [Get database metadata](/docs/reference/api/v1-get-database-metadata) | | | | [Get database openapi](/docs/reference/api/v1-get-database-openapi) | | | | [Get postgres upgrade eligibility](/docs/reference/api/v1-get-postgres-upgrade-eligibility)[^1] | | | | [Get postgres upgrade status](/docs/reference/api/v1-get-postgres-upgrade-status)[^1] | | | | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | | [Get project PgBouncer config](/docs/reference/api/v1-get-project-pgbouncer-config) | | | | [Read only query](/docs/reference/api/v1-read-only-query) | | | | [Run a query](/docs/reference/api/v1-run-a-query) | | | Read-write | [Create login role](/docs/reference/api/v1-create-login-role) | | | | [Delete login roles](/docs/reference/api/v1-delete-login-roles) | | | | [Run a query](/docs/reference/api/v1-run-a-query) | | | | [Upgrade postgres version](/docs/reference/api/v1-upgrade-postgres-version)[^4] | | Database Config | Read | [Get postgres config](/docs/reference/api/v1-get-postgres-config) | | | | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | Read-write | [Update database password](/docs/reference/api/v1-update-database-password) | | | | [Update postgres config](/docs/reference/api/v1-update-postgres-config) | | Database JIT | Read | [Authorize JIT access](/docs/reference/api/v1-authorize-jit-access) | | | | [Get JIT access](/docs/reference/api/v1-get-jit-access) | | | Read-write | [Delete invite external JIT access](/docs/reference/api/v1-delete-invite-external-jit-access) | | | | [Delete JIT access](/docs/reference/api/v1-delete-jit-access) | | | | [Invite external JIT access](/docs/reference/api/v1-invite-external-jit-access) | | | | [List JIT access](/docs/reference/api/v1-list-jit-access) | | | | [Update JIT access](/docs/reference/api/v1-update-jit-access) | | Network Bans | Read | [List all network bans](/docs/reference/api/v1-list-all-network-bans) | | | | [List all network bans enriched](/docs/reference/api/v1-list-all-network-bans-enriched) | | | Read-write | [Delete network bans](/docs/reference/api/v1-delete-network-bans) | | Network Restrictions | Read | [Get network restrictions](/docs/reference/api/v1-get-network-restrictions) | | | | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | Read-write | [Patch network restrictions](/docs/reference/api/v1-patch-network-restrictions) | | | | [Update network restrictions](/docs/reference/api/v1-update-network-restrictions) | | Migrations | Read | [Get a migration](/docs/reference/api/v1-get-a-migration) | | | | [List migration history](/docs/reference/api/v1-list-migration-history) | | | Read-write | [Apply a migration](/docs/reference/api/v1-apply-a-migration) | | | | [Patch a migration](/docs/reference/api/v1-patch-a-migration) | | | | [Rollback migrations](/docs/reference/api/v1-rollback-migrations) | | | | [Upsert a migration](/docs/reference/api/v1-upsert-a-migration) | | Connection Pooling | Read | [Get pooler config](/docs/reference/api/v1-get-pooler-config) | | | Read-write | [Update pooler config](/docs/reference/api/v1-update-pooler-config) | | Read-only Mode | Read | [Get read-only mode status](/docs/reference/api/v1-get-readonly-mode-status) | | | Read-write | [Disable read-only mode temporarily](/docs/reference/api/v1-disable-readonly-mode-temporarily) | | SSL Enforcement | Read | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | | [Get SSL enforcement config](/docs/reference/api/v1-get-ssl-enforcement-config) | | | Read-write | [Update SSL enforcement config](/docs/reference/api/v1-update-ssl-enforcement-config) | | Database Webhooks | Read-write | [Enable database webhook](/docs/reference/api/v1-enable-database-webhook) | | **Application services** | | | | API Keys | Read | [Get project API key](/docs/reference/api/v1-get-project-api-key) | | | | [Get project API keys](/docs/reference/api/v1-get-project-api-keys) | | | | [Get project legacy API keys](/docs/reference/api/v1-get-project-legacy-api-keys) | | | Read-write | [Create project API key](/docs/reference/api/v1-create-project-api-key) | | | | [Delete project API key](/docs/reference/api/v1-delete-project-api-key) | | | | [Update project API key](/docs/reference/api/v1-update-project-api-key) | | | | [Update project legacy API keys](/docs/reference/api/v1-update-project-legacy-api-keys) | | API Key Secrets | Read | [Get project API key](/docs/reference/api/v1-get-project-api-key)[^6] | | | | [Get project API keys](/docs/reference/api/v1-get-project-api-keys)[^6] | | Auth Config | Read | [Get a SSO provider](/docs/reference/api/v1-get-a-sso-provider) | | | | [Get auth service config](/docs/reference/api/v1-get-auth-service-config) | | | | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | | [Get project TPA integration](/docs/reference/api/v1-get-project-tpa-integration) | | | | [List all SSO provider](/docs/reference/api/v1-list-all-sso-provider) | | | | [List project TPA integrations](/docs/reference/api/v1-list-project-tpa-integrations) | | | Read-write | [Create a SSO provider](/docs/reference/api/v1-create-a-sso-provider) | | | | [Create project TPA integration](/docs/reference/api/v1-create-project-tpa-integration) | | | | [Delete a SSO provider](/docs/reference/api/v1-delete-a-sso-provider) | | | | [Delete project TPA integration](/docs/reference/api/v1-delete-project-tpa-integration) | | | | [Update a SSO provider](/docs/reference/api/v1-update-a-sso-provider) | | | | [Update auth service config](/docs/reference/api/v1-update-auth-service-config)[^3] | | Auth Signing Keys | Read | [Get legacy signing key](/docs/reference/api/v1-get-legacy-signing-key) | | | | [Get project signing key](/docs/reference/api/v1-get-project-signing-key) | | | | [Get project signing keys](/docs/reference/api/v1-get-project-signing-keys) | | | Read-write | [Create legacy signing key](/docs/reference/api/v1-create-legacy-signing-key) | | | | [Create project signing key](/docs/reference/api/v1-create-project-signing-key) | | | | [Remove project signing key](/docs/reference/api/v1-remove-project-signing-key) | | | | [Update project signing key](/docs/reference/api/v1-update-project-signing-key) | | Data API Config | Read | [Get PostgREST service config](/docs/reference/api/v1-get-postgrest-service-config) | | | | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | Read-write | [Update PostgREST service config](/docs/reference/api/v1-update-postgrest-service-config) | | Data API JWT Secret | Read | [Get PostgREST service config](/docs/reference/api/v1-get-postgrest-service-config)[^7] | | Edge Functions | Read | [Get a function](/docs/reference/api/v1-get-a-function) | | | | [Get a function body](/docs/reference/api/v1-get-a-function-body) | | | | [List all functions](/docs/reference/api/v1-list-all-functions) | | | Read-write | [Bulk update functions](/docs/reference/api/v1-bulk-update-functions) | | | | [Create a function](/docs/reference/api/v1-create-a-function) | | | | [Delete a function](/docs/reference/api/v1-delete-a-function) | | | | [Deploy a function](/docs/reference/api/v1-deploy-a-function) | | | | [Update a function](/docs/reference/api/v1-update-a-function) | | Edge Function Secrets | Read | [List all secrets](/docs/reference/api/v1-list-all-secrets) | | | Read-write | [Bulk create secrets](/docs/reference/api/v1-bulk-create-secrets) | | | | [Bulk delete secrets](/docs/reference/api/v1-bulk-delete-secrets) | | Realtime Config | Read | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | | [Get realtime config](/docs/reference/api/v1-get-realtime-config) | | | Read-write | [Shutdown realtime](/docs/reference/api/v1-shutdown-realtime) | | | | [Update realtime config](/docs/reference/api/v1-update-realtime-config) | | Storage | Read | [List all buckets](/docs/reference/api/v1-list-all-buckets) | | Storage Config | Read | [Get project config](/docs/reference/api/v2-get-project-config)[^5] | | | | [Get storage config](/docs/reference/api/v1-get-storage-config) | | | Read-write | [Update storage config](/docs/reference/api/v1-update-storage-config) | | Compute | Read | [Get a compute instance](/docs/reference/api/v2-get-a-compute-instance) | | | | [List all compute instances](/docs/reference/api/v2-list-all-compute-instances) | | | Read-write | [Create compute instance upload](/docs/reference/api/v2-create-compute-instance-upload) | | | | [Delete a compute instance](/docs/reference/api/v2-delete-a-compute-instance) | | | | [Deploy a compute instance](/docs/reference/api/v2-deploy-a-compute-instance) | | **Infrastructure and delivery** | | | | Development Branches | Read | [Get a branch](/docs/reference/api/v1-get-a-branch) | | | | [Get a branch config](/docs/reference/api/v1-get-a-branch-config) | | | | [List all branches](/docs/reference/api/v1-list-all-branches) | | | Read-write | [Create a branch](/docs/reference/api/v1-create-a-branch) | | | | [Create a branch](/docs/reference/api/v2-create-a-branch) | | | | [Delete a branch](/docs/reference/api/v1-delete-a-branch) | | | | [Diff a branch](/docs/reference/api/v1-diff-a-branch) | | | | [Merge a branch](/docs/reference/api/v1-merge-a-branch) | | | | [Push a branch](/docs/reference/api/v1-push-a-branch) | | | | [Reset a branch](/docs/reference/api/v1-reset-a-branch) | | | | [Restore a branch](/docs/reference/api/v1-restore-a-branch) | | | | [Update a branch config](/docs/reference/api/v1-update-a-branch-config) | | Production Branches | Read | [Get a branch](/docs/reference/api/v1-get-a-branch) | | | | [Get a branch config](/docs/reference/api/v1-get-a-branch-config) | | | | [List all branches](/docs/reference/api/v1-list-all-branches) | | | Read-write | [Create a branch](/docs/reference/api/v1-create-a-branch) | | | | [Create a branch](/docs/reference/api/v2-create-a-branch) | | | | [Delete a branch](/docs/reference/api/v1-delete-a-branch) | | | | [Diff a branch](/docs/reference/api/v1-diff-a-branch) | | | | [Disable preview branching](/docs/reference/api/v1-disable-preview-branching) | | | | [Merge a branch](/docs/reference/api/v1-merge-a-branch) | | | | [Push a branch](/docs/reference/api/v1-push-a-branch) | | | | [Reset a branch](/docs/reference/api/v1-reset-a-branch) | | | | [Restore a branch](/docs/reference/api/v1-restore-a-branch) | | | | [Update a branch config](/docs/reference/api/v1-update-a-branch-config) | | Custom Domains | Read | [Get hostname config](/docs/reference/api/v1-get-hostname-config) | | | Read-write | [Activate custom hostname](/docs/reference/api/v1-activate-custom-hostname) | | | | Delete hostname config | | | | [Update hostname config](/docs/reference/api/v1-update-hostname-config) | | | | [Verify DNS config](/docs/reference/api/v1-verify-dns-config) | | Add-ons | Read | [List project add-ons](/docs/reference/api/v1-list-project-addons) | | | Read-write | [Apply project add-on](/docs/reference/api/v1-apply-project-addon) | | | | [Remove project add-on](/docs/reference/api/v1-remove-project-addon) | | Disk Config | Read | [Get database disk](/docs/reference/api/v1-get-database-disk) | | | | [Get disk utilization](/docs/reference/api/v1-get-disk-utilization) | | | | [Get project disk auto-scaling config](/docs/reference/api/v1-get-project-disk-autoscale-config) | | | Read-write | [Modify database disk](/docs/reference/api/v1-modify-database-disk) | | Read Replicas | Read-write | [Remove a read replica](/docs/reference/api/v1-remove-a-read-replica) | | | | [Setup a read replica](/docs/reference/api/v1-setup-a-read-replica) | | Vanity Subdomain | Read | [Get vanity subdomain config](/docs/reference/api/v1-get-vanity-subdomain-config) | | | Read-write | [Activate vanity subdomain config](/docs/reference/api/v1-activate-vanity-subdomain-config) | | | | [Check vanity subdomain availability](/docs/reference/api/v1-check-vanity-subdomain-availability) | | | | [Deactivate vanity subdomain config](/docs/reference/api/v1-deactivate-vanity-subdomain-config) | | **Account and organization** | | | | Organizations | Read | [List all organizations](/docs/reference/api/v1-list-all-organizations) | | | Read-write | [Create an organization](/docs/reference/api/v1-create-an-organization) | | Projects (account-wide) | Read | [List all projects](/docs/reference/api/v1-list-all-projects) | | SQL Snippets (account-wide) | Read | [Get a snippet](/docs/reference/api/v1-get-a-snippet) | | | | [List all snippets](/docs/reference/api/v1-list-all-snippets) | | Organization Settings | Read | [Get an organization](/docs/reference/api/v1-get-an-organization) | | | | [Get organization entitlements](/docs/reference/api/v1-get-organization-entitlements) | | | Read-write | [Assign organization member role](/docs/reference/api/v2-assign-organization-member-role) | | | | [OAuth authorize project claim](/docs/reference/api/v1-oauth-authorize-project-claim)[^2] | | | | [Transfer a project](/docs/reference/api/v2-transfer-a-project) | | Organization Members | Read | [List organization members](/docs/reference/api/v1-list-organization-members) | | | | [List organization members](/docs/reference/api/v2-list-organization-members) | | | | [List organization roles](/docs/reference/api/v2-list-organization-roles) | | | Read-write | [Create organization invitations](/docs/reference/api/v2-create-organization-invitations) | | | | [Delete organization invitations](/docs/reference/api/v2-delete-organization-invitations) | | Organization Projects | Read | [Get all projects for organization](/docs/reference/api/v1-get-all-projects-for-organization) | | | | [List organization GitHub connections](/docs/reference/api/v2-list-organization-github-connections) | | | | [List organization projects](/docs/reference/api/v2-list-organization-projects) | | | Read-write | [Create a project](/docs/reference/api/v1-create-a-project) | | Platform Webhooks (organization) | Read | [Get delivery](/docs/reference/api/v2-organizations-slug-webhooks-deliveries-id-get) | | | | [Get endpoint](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-id-get) | | | | [List deliveries](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-id-deliveries-get) | | | | [List endpoints](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-get) | | | Read-write | [Create endpoint](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-post) | | | | [Delete all endpoints](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-delete) | | | | [Delete endpoint](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-id-delete) | | | | [Retry delivery](/docs/reference/api/v2-organizations-slug-webhooks-deliveries-id-retry-post) | | | | [Send test event](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-id-test-post) | | | | [Update endpoint](/docs/reference/api/v2-organizations-slug-webhooks-endpoints-id-patch) | [^1]: Requires **Project Settings** (Read) and **Database** (Read). [^2]: Requires **Organization Settings** (Read-write) and **Project Settings** (Read-write). [^3]: Requires **Auth Config** (Read-write) and **Project Settings** (Read-write). [^4]: Requires **Project Settings** (Read-write) and **Database** (Read-write). [^5]: Requires **Database Config** (Read), **Database** (Read), **SSL Enforcement** (Read), **Network Restrictions** (Read), **Auth Config** (Read), **Data API Config** (Read), **Realtime Config** (Read), and **Storage Config** (Read). [^6]: Requires **API Keys** (Read) and **API Key Secrets** (Read). [^7]: Requires **Data API Config** (Read) and **Data API JWT Secret** (Read). ## MCP tools A scoped personal access token used to authenticate the [MCP server](/docs/guides/ai-tools/mcp) can only call the tools its granted permissions unlock. See [Available tools](/docs/guides/ai-tools/mcp#available-tools) for what each tool does. | MCP tool | Required permission | | ----------------------------- | ----------------------------------------------------------------------------- | | `apply_migration` | **Migrations** (Read-write) | | `confirm_cost` | None (always available) | | `create_branch` | **Development Branches** (Read-write) or **Production Branches** (Read-write) | | `create_edge_function_secret` | **Edge Function Secrets** (Read-write) and **Edge Function Secrets** (Read) | | `create_project` | **Organization Projects** (Read-write) | | `delete_branch` | **Production Branches** (Read-write) or **Development Branches** (Read-write) | | `deploy_edge_function` | **Edge Functions** (Read-write) | | `execute_sql` | **Database** (Read) | | `generate_typescript_types` | **Database** (Read) | | `get_advisors` | **Advisors** (Read) | | `get_cost` | **Organization Settings** (Read) and **Projects (account-wide)** (Read) | | `get_edge_function` | **Edge Functions** (Read) | | `get_logs` | **Logs** (Read) | | `get_organization` | **Organization Settings** (Read) | | `get_project` | **Project Settings** (Read) | | `get_project_url` | **Project Settings** (Read) | | `get_publishable_keys` | **API Keys** (Read) | | `get_storage_config` | **Storage Config** (Read) | | `list_branches` | **Development Branches** (Read) or **Production Branches** (Read) | | `list_edge_functions` | **Edge Functions** (Read) | | `list_extensions` | **Database** (Read) | | `list_migrations` | **Migrations** (Read) | | `list_organizations` | **Organizations** (Read) | | `list_projects` | **Projects (account-wide)** (Read) | | `list_storage_buckets` | **Storage** (Read) | | `list_tables` | **Database** (Read) | | `merge_branch` | **Production Branches** (Read-write) or **Development Branches** (Read-write) | | `pause_project` | **Project Settings** (Read-write) | | `query_logs` | **Logs** (Read) | | `rebase_branch` | **Production Branches** (Read-write) or **Development Branches** (Read-write) | | `reset_branch` | **Production Branches** (Read-write) or **Development Branches** (Read-write) | | `restore_project` | **Project Settings** (Read-write) | | `search_docs` | None (always available) | | `update_storage_config` | **Storage Config** (Read-write) |