Supabase

Ace watches Supabase project health and investigates database incidents through the Management API. It never runs SQL and never sees your table data.

What Ace readsCopy Anchor Link

Ace reads Supabase while it investigates a workload that lists it under Investigation sources or routes its alerts. It reads only the projects you list.

• Project status and the health of Postgres, logins, the connection pooler, the dedicated pooler, Auth, the Data API, Realtime and Storage. Ace also reads read-only mode, disk use, max_connections and statement_timeout.
• A current metrics snapshot: Postgres up, CPU per core, memory, disk, I/O, backends, pooler connections and replication lag.
• One log source at a time over the incident window, for example edge, Postgres, Auth or edge functions.
• Performance health checks and security advisors, errors first.
• Request counts per service and edge function invocation stats. Supabase keeps 7 days of these.
• Edge function deploys, migration versions and branch action runs around the incident.

For the System Map, Ace reads projects, the connection pooler, custom domains and branches.

If the token lacks an optional permission, Ace skips the reads that need it and uses the rest.

What Ace never readsCopy Anchor Link

Ace can send only the Supabase requests listed above. It blocks the SQL endpoint, function code, API keys and every write other than the four actions below before the request leaves Ace. Ace never needs the Database permission, so don't grant it.

What Ace can changeCopy Anchor Link

Every Supabase action needs a person's approval and never runs automatically, whatever your policy says. Ace proposes them only after an admin turns on Allow Ace to run approved actions for the connection, and only where the token has Read-write. See Actions and approvals.

Ace doesn't change the pooler's max client connections or restart single services, and it refuses to write to any project outside the connection.

Supabase can't report a token's permissions, so Settings shows that each write permission is checked when the action runs. Pool size is the exception, because if the token can't read the pooler, Ace knows it can't change it either.

What opens an incidentCopy Anchor Link

Problems open incidents only on workloads that route this connection (Integration alerts on, Supabase selected). Supabase has no webhook, so Ace checks routed projects on a schedule. An incident opens while a problem is present and resolves when it clears.

These advisor health checks open incidents:

• Critical: database down, database not reachable, database connections failing.
• High: connection limit reached, an instance alert firing, high Data API or Auth error rate.
• Medium: high Storage or edge function error rate, project not active.

These add context and never open an incident:

• Unhealthy Postgres logins, connection pooler, dedicated pooler or Storage.
• Project status, such as unhealthy, restoring, inactive, or a failed restore or pause.

If Ace loses read access to a project, its open problems expire after a while, so a lost permission can't hold an incident open.

Edge function deploys, migrations and branch action runs (migrate and deploy steps) join the change ledger whether or not a workload routes the connection, and they never open incidents. Supabase doesn't report when a migration was applied, so Ace dates it when it first sees it.

Before you startCopy Anchor Link

• The admin role in Ace.
• A scoped personal access token (sbp_fc…). Ace refuses Classic (Legacy) tokens, which carry your whole account.
• The Project ID of each project Ace should read. It's the 20-letter ID under Project Settings > General > Project ID, and also the part after /project/ in the dashboard URL.

Credentials and permissionsCopy Anchor Link

Ace uses one scoped access token, limited to the projects you list. Don't use the Read-only preset, which also grants Database and secret reads.

Set upCopy Anchor Link

1. Create a scoped access token in SupabaseCopy Anchor Link

1. Open Account > Access Tokens and choose Generate new token. Don't use Create legacy token.
2. Name it Ace and set Expires in (90 days, or a custom date up to a year).
3. Under Resource access, choose Project, then the organization, then the projects Ace should read.
4. Under Permissions, keep Preset at No access. Set Read on Project Settings, Logs, Advisors, Read-only Mode and Disk Config. Optionally set Read on Usage Analytics, Action Runs, Migrations, Database Config, Connection Pooling, Edge Functions and Development Branches. Leave every other row at None, especially Database.
5. Only for approved changes, set Read-write on Connection Pooling, Read-only Mode and Disk Config. Set it on Project Settings only if Ace may restart the project. Leave Database at None.
6. Review access, select Create token, and copy the sbp_fc… token.

2. Connect Supabase in AceCopy Anchor Link

1. Open Settings > Data sources and choose Supabase.

2. Fill in the form:

   Field	What to enter
   Scoped access token	The sbp_fc… token.
   Project IDs	A comma-separated list of the Project IDs Ace reads. Ace reads no other project.

3. Select Connect Supabase. Ace checks the token before it saves, and it never sends a classic token to Supabase.

3. Route alerts to a workloadCopy Anchor Link

Open the workload in Ace, turn on Integration alerts, and select Supabase as a source.

4. Optional: allow actionsCopy Anchor Link

Turn on Allow Ace to run approved actions.

Confirm it's workingCopy Anchor Link

The connection runs the checks scoped_token, project_settings_read, logs_read, advisors_read, disk_config_read and read_only_mode_read. Re-validate reruns them. These failures come up most often:

• A classic token: "This is a classic (Legacy) token with access to your whole account. Create a scoped token (sbp_fc…) limited to these projects."
• A listed project the token can't see, which the check names before asking you to scope the token to it with Project Settings: Read.
• No readable project: "No Supabase project could be read."

DisconnectCopy Anchor Link

1. In Ace, open the Supabase connection under Settings > Data sources and select Disconnect. To stop actions and keep the connection, turn off Allow Ace to run approved actions instead.
2. In Supabase, delete the Ace token under Account > Access Tokens. Ace creates nothing in Supabase.

Next stepsCopy Anchor Link

• PlanetScale
• Actions and approvals
• All integrations