Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Scoped tokens: supabase link needs API Key Secrets even though db push only needs the DB password

Aperta
  • Qualcosa non va?
#7,165 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, cli

Direzione di ricerca

The failing call is GET /v1/projects/<ref>/api-keys, made during supabase link after the project lookup succeeds; start by finding where link requests API keys and whether a 403 there aborts the command. Reproduce with a project-scoped token that lacks API Key Secrets, then run the link command with --debug to confirm the failing request. Done means link completes without the secret keys, or a 403 names the missing permission in missing_permissions as the docs describe.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

🐛 Bug supabase/cli
Affected area

Auth

Supabase CLI version

2.108.0

Operating system

Ubuntu 24.04 (GitHub Actions ubuntu-latest); also reproduced on Windows 11

Installation method

None

Command
SUPABASE_ACCESS_TOKEN=<project-scoped PAT> supabase link --project-ref <ref> --debug
Actual output
Using access token from env var...
Supabase CLI 2.120.0
HTTP GET: https://api.supabase.com/v1/projects/<ref>
HTTP GET: https://api.supabase.com/v1/projects/<ref>/api-keys
Authorization failed for the access token and project ref pair: {"message":"Your account does not have the necessary privileges to access this endpoint. For more details, refer to our documentation https://supabase.com/docs/guides/platform/access-control"}
Expected behavior

supabase link (followed by supabase db push) works with a project-scoped token that has Migrations read-write and project/database read, without needing API Key Secrets. db push uses the database password and never needs the secret service_role key, so link shouldn't fetch secret keys, or should skip them when the token lacks API Key Secrets. If a permission is missing, the 403 should name it in missing_permissions, as the docs say.

Steps to reproduce
  1. Create a scoped personal access token (resource access: one project) with: Migrations read-write; Project Settings, Database, Database Config, Connection Pooling, API Keys read. Created by the organization Owner.
  2. Run: SUPABASE_ACCESS_TOKEN= supabase link --project-ref --debug
  3. It fails on GET /v1/projects//api-keys with "Your account does not have the necessary privileges to access this endpoint".
  4. Add API Key Secrets: read to a new token → link succeeds.
    Workaround: supabase db push --db-url (no link, no token).
Crash report ID

No response

Docker and service versions
Additional context

No response

Lingua principale
TypeScript
Stelle
2.4k
Fork
533
Merge medio
22h 20m
PR unite (30g)
370

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di supabase/cli

Tutte le issue di supabase/cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.