Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Scoped tokens: supabase link needs API Key Secrets even though db push only needs the DB password

Abierto
  • ¿Algo no está bien?
#7,165 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
authentication, cli

Línea de trabajo

The failing call is GET /v1/projects/<ref>/api-keys, made during supabase link after the project lookup succeeds; start by finding where link requests API keys and whether a 403 there aborts the command. Reproduce with a project-scoped token that lacks API Key Secrets, then run the link command with --debug to confirm the failing request. Done means link completes without the secret keys, or a 403 names the missing permission in missing_permissions as the docs describe.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

🐛 Bug supabase/cli
Affected area

Auth

Supabase CLI version

2.108.0

Operating system

Ubuntu 24.04 (GitHub Actions ubuntu-latest); also reproduced on Windows 11

Installation method

None

Command
SUPABASE_ACCESS_TOKEN=<project-scoped PAT> supabase link --project-ref <ref> --debug
Actual output
Using access token from env var...
Supabase CLI 2.120.0
HTTP GET: https://api.supabase.com/v1/projects/<ref>
HTTP GET: https://api.supabase.com/v1/projects/<ref>/api-keys
Authorization failed for the access token and project ref pair: {"message":"Your account does not have the necessary privileges to access this endpoint. For more details, refer to our documentation https://supabase.com/docs/guides/platform/access-control"}
Expected behavior

supabase link (followed by supabase db push) works with a project-scoped token that has Migrations read-write and project/database read, without needing API Key Secrets. db push uses the database password and never needs the secret service_role key, so link shouldn't fetch secret keys, or should skip them when the token lacks API Key Secrets. If a permission is missing, the 403 should name it in missing_permissions, as the docs say.

Steps to reproduce
  1. Create a scoped personal access token (resource access: one project) with: Migrations read-write; Project Settings, Database, Database Config, Connection Pooling, API Keys read. Created by the organization Owner.
  2. Run: SUPABASE_ACCESS_TOKEN= supabase link --project-ref --debug
  3. It fails on GET /v1/projects//api-keys with "Your account does not have the necessary privileges to access this endpoint".
  4. Add API Key Secrets: read to a new token → link succeeds.
    Workaround: supabase db push --db-url (no link, no token).
Crash report ID

No response

Docker and service versions
Additional context

No response

Lenguaje dominante
TypeScript
Estrellas
2.4k
Forks
533
Merge medio
21 h 49 min
PR fusionados (30 d)
371

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de supabase/cli

Todos los issues de supabase/cli

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.