Mattering Automations Supabase integration

Connect Supabase to Mattering Automations: organizations, projects, SQL and migrations, preview branches, Edge Functions, secrets, and project config as workflow steps, authenticated with a Supabase personal access token.

Get the credential Connect Verify Node reference Troubleshooting

The Mattering Automations Supabase integration adds the Supabase Management API to your automation canvas: list organizations and projects, create, pause, restart, and delete projects, run SQL and apply migrations against a project database, drive preview branches, manage Edge Functions, secrets, and API keys, read and update project config, and pull security advisors, performance advisors, logs, and usage counts.

Scope matters here, so it is stated up front. This integration covers the Management API at api.supabase.com, which is the administration surface for your organizations and projects. It does not cover the per-project Data API (PostgREST), Auth, Storage objects, or Realtime, because each of those lives on your project's own host and uses a per-project key, while a connector holds one credential per workspace. Table data is still reachable through the SQL nodes, which is covered below.

Setup takes a few minutes: create a personal access token in your Supabase account settings, attach it as a credential in Mattering, and run the List Organizations node to confirm it works. This guide walks through each step and ends with the full node reference.

Before you start

A Supabase account with access to the organizations and projects you want to automate.
A Mattering workspace with access to the Automations app.
Membership of the Supabase organization you are targeting, with a role that permits the actions your workflow will take. A personal access token carries your own permissions and nothing more.
For a project's ref, the 20 character project identifier from the dashboard URL. Most nodes need it, and Supabase: List Projects returns it for every project you can reach.

Create a Supabase personal access token

Mattering authenticates to the Supabase Management API with a personal access token, sent as a bearer credential. You create it once from your Supabase account settings, not from an individual project.

Go to Access Tokens (the page is also reachable at supabase.com/dashboard/account/tokens).

Click Generate new token, give it a name that says where it will be used, such as Mattering Automations, and confirm.

Copy the token. It is prefixed sbp_.

The token is shown once, at creation. If you close the dialog without copying it, you cannot retrieve it later; generate a new one and revoke the old.

A personal access token is not the same thing as a project API key. Project keys (anon, service_role, publishable, secret) come from a project's settings and address only that project's Data API. This integration needs the account level personal access token.

Connect Supabase to Mattering

In Mattering Automations, open Connectors and click Add Connector.

Choose Supabase from the list.

Click Create new credential, paste your personal access token, and save.

The credential is stored encrypted in Google Secret Manager and never appears in workflow logs.

Click Connect. All 69 Supabase nodes appear in your canvas palette.

This connector has no separate connection test button. Supabase: List Organizations takes no parameters and is the auth probe: run it once and a successful response tells you the token is good.

Verify it works

After connecting, open any automation canvas and check the palette: a Supabase section should list the query and action nodes. Drop Supabase: List Organizations onto the canvas, leave the config empty, and run a test step. It is a safe read that takes no arguments, so a successful response returns every organization your token can see and confirms the credential works.

Next, add Supabase: List Projects and run it. The response gives you each project's ref, region, status, and Postgres version. Copy a ref, because almost every other node needs it.

To confirm database access, add Supabase: Run Read-Only SQL Query, set the ref, and run a harmless statement such as select now(). It executes as the read-only Postgres role, so it cannot change anything. If you would rather not touch SQL yet, Supabase: Get Project Health with the same ref reports per service status instead.

Node reference

69 nodes, generated from the connector itself so this reference always matches what ships.

Read and query nodes 42

Supabase: Diff Branch

supabase_diff_branch

[Beta] Diff a preview branch against its parent. Returns SQL text, not JSON, so the body arrives under data.raw_body.

Supabase: Generate TypeScript Types

supabase_generate_typescript_types

Generate TypeScript type definitions for the project's schema. Returns the .ts source as a string.

Supabase: Get API Usage Counts

supabase_get_usage_api_counts

Get request counts per service (auth, realtime, rest, storage) bucketed over an interval.

Supabase: Get Auth Config

supabase_get_auth_config

Get the project's GoTrue auth settings: site URL, redirect allow list, token expiry, provider toggles.

Supabase: Get Branch Config

supabase_get_branch_config

Get a branch's database connection config: Postgres version, host, port, and (when the token is allowed to see them) credentials.

Supabase: Get Branch by Name

supabase_get_branch

Get one preview branch on a project by its branch name.

Supabase: Get Connection Pooler Config

supabase_get_pooler_config

Get the project's Supavisor pooler config, including the pooled connection strings.

Supabase: Get Database Context

supabase_get_database_context

Get database metadata for the project: databases, schemas, and tables. Useful as agent grounding before writing SQL.

Supabase: Get Edge Function

supabase_get_function

Get one Edge Function's metadata by slug.

Supabase: Get Edge Function Body

supabase_get_function_body

Retrieve an Edge Function's deployed source. Non-JSON bodies arrive under data.raw_body.

Supabase: Get Network Restrictions

supabase_get_network_restrictions

[Beta] Get the project's allowed database CIDR ranges (IPv4 and IPv6) and whether they are applied.

Supabase: Get Organization

supabase_get_organization

Get one organization: name, plan, opt-in tags, and allowed release channels.

Supabase: Get Performance Advisors

supabase_get_performance_advisors

Run Supabase's performance lints: unindexed foreign keys, unused indexes, duplicate indexes, RLS init-plan issues.

Supabase: Get PostgREST Config

supabase_get_postgrest_config

Get the project's PostgREST (Data API) config: exposed schemas, max rows, pool settings.

Supabase: Get PostgREST OpenAPI Spec

supabase_get_postgrest_openapi

Get the PostgREST-generated OpenAPI document describing the project's Data API (tables, views, RPC functions).

Supabase: Get Postgres Config

supabase_get_postgres_config

Get the project's tunable Postgres parameters (work_mem, max_connections, statement_timeout, logging).

Supabase: Get Profile

supabase_get_profile

Get the Supabase user profile that owns the personal access token.

Supabase: Get Project

supabase_get_project

Get one project: name, org, region, status, and database host/version.

Supabase: Get Project Health

supabase_get_project_health

Health check per service (auth, db, pooler, realtime, rest, storage). Returns healthy/status per requested service.

Supabase: Get Realtime Config

supabase_get_realtime_config

Get the project's Realtime limits: concurrent users, events/second, payload size, presence.

Supabase: Get SQL Snippet

supabase_get_snippet

Get one saved SQL Editor snippet, including its SQL content.

Supabase: Get SSL Enforcement

supabase_get_ssl_enforcement

[Beta] Get whether the project requires SSL for database connections.

Supabase: Get Security Advisors

supabase_get_security_advisors

Run Supabase's security lints on the project: exposed auth tables, RLS disabled or missing policies, security-definer views.

Supabase: Get Storage Config

supabase_get_storage_config

Get the project's Storage config: file size limit and feature toggles (image transformation, S3 protocol).

Supabase: Get Upgrade Eligibility

supabase_get_upgrade_eligibility

[Beta] Check whether the project can be upgraded, with target versions, duration estimate, and blocking validation errors.

Supabase: Get Upgrade Status

supabase_get_upgrade_status

[Beta] Get the latest status of a project's Postgres upgrade.

Supabase: List API Keys

supabase_list_api_keys

List the project's API keys (legacy anon/service_role plus the newer publishable/secret keys). Set reveal to true to return the key values. Treat the output as a secret.

Supabase: List Available Regions

supabase_list_available_regions

[Beta] List the regions a new project can be created in for an organization, with Supabase's recommended smart group.

Supabase: List Backups

supabase_list_backups

List available database backups plus the project's PITR/WAL-G settings.

Supabase: List Branches

supabase_list_branches

List all preview branches on a project, with migration status and git branch links.

Supabase: List Edge Functions

supabase_list_functions

List the project's Edge Functions with slug, status, and version.

Supabase: List Migrations

supabase_list_migrations

List the migration versions applied to the project database.

Supabase: List Organization Members

supabase_list_organization_members

List the members of an organization with their role and MFA status.

Supabase: List Organization Projects

supabase_list_organization_projects

List an organization's projects with pagination, search, sorting, and status filtering. Includes preview-branch projects (is_branch = true).

Supabase: List Organizations

supabase_list_organizations

List every Supabase organization the personal access token can see. Takes no parameters, so this is the connector's auth probe. run it first to confirm the token works.

Supabase: List Projects

supabase_list_projects

List every project the token can reach, across all organizations, with region, status, and Postgres version.

Supabase: List Restore Versions

supabase_list_restore_versions

List the Postgres versions a paused/restorable project can be restored onto.

Supabase: List SQL Snippets

supabase_list_snippets

List the saved SQL Editor snippets visible to the token's user, optionally scoped to one project.

Supabase: List Secrets

supabase_list_secrets

List the project's Edge Function secrets (environment variables) and their values.

Supabase: List Storage Buckets

supabase_list_storage_buckets

List the project's Storage buckets and whether each is public. Object-level operations live on the per-project Storage API, which this connector does not cover.

Supabase: Query Logs

supabase_get_logs

Query the project's logs (edge, Postgres, auth, functions) with a SQL statement over the log tables, optionally windowed by ISO timestamps.

Supabase: Run Read-Only SQL Query

supabase_run_readonly_query

[Beta] Run SQL as the supabase_read_only_user role. The safe way to read project data from an automation. Writes are rejected by the database, not by us.

Action nodes 27

Supabase: Apply Migration

supabase_apply_migration

Apply a database migration and record it in the migration history. Schema changes take effect immediately on the target project.

Supabase: Apply Network Restrictions

supabase_apply_network_restrictions

[Beta] Replace the project's database allow list. This REPLACES the existing CIDRs. Omitting your own range locks you out of the database.

Supabase: Create API Key

supabase_create_api_key

Create a new publishable or secret API key for a project.

Supabase: Create Branch

supabase_create_branch

Create a preview branch on a project. A branch provisions its own Postgres instance, so it is billable on paid plans.

Supabase: Create Edge Function

supabase_create_function

Create an Edge Function from inline source (the JSON body variant of the create endpoint). The function goes live once deployed.

Supabase: Create Project

supabase_create_project

Create a new Supabase project in an organization. Billable on paid plans. A new project on a Pro org starts accruing compute charges.

Supabase: Create Secrets

supabase_create_secrets

Bulk-create or overwrite Edge Function secrets. An existing secret with the same name is replaced.

Supabase: Delete API Key

supabase_delete_api_key

DESTRUCTIVE: permanently revokes an API key. Every client still presenting it starts getting 401s immediately.

Supabase: Delete Branch

supabase_delete_branch

DESTRUCTIVE: deletes a preview branch and the branch database behind it. Any data written only on the branch is lost.

Supabase: Delete Edge Function

supabase_delete_function

DESTRUCTIVE: permanently removes an Edge Function and its deployed source. Callers of its URL start getting 404s.

Supabase: Delete Project

supabase_delete_project

DESTRUCTIVE: permanently deletes the project and its database. The data is not recoverable through the API; take a backup first.

Supabase: Delete Secrets

supabase_delete_secrets

DESTRUCTIVE: permanently removes the named Edge Function secrets. Functions reading them start failing on the next invocation.

Supabase: Enable Database Webhooks

supabase_enable_database_webhooks

[Beta] Enable Database Webhooks (the supabase_functions schema) on the project.

Supabase: Merge Branch

supabase_merge_branch

Merge a preview branch's migrations into its parent project. This applies schema changes to production. Review the diff first.

Supabase: Pause Project

supabase_pause_project

Pause a project. The database goes offline and every API/Data endpoint for it stops answering until it is restored from the dashboard. Disruptive, but reversible.

Supabase: Push Branch

supabase_push_branch

Push pending migrations to a preview branch. Returns the workflow run id to poll.

Supabase: Reset Branch

supabase_reset_branch

DESTRUCTIVE: wipes the preview branch database and re-runs its migrations from scratch. All data on the branch is discarded.

Supabase: Restart Project

supabase_restart_project

Restart a project's services. Causes a short outage while it comes back up.

Supabase: Run SQL Query

supabase_run_query

[Beta] Run arbitrary SQL against the project database with full privileges. DESTRUCTIVE: the statement is whatever you send, so DROP/DELETE/TRUNCATE run for real and are not reversible. Prefer Supabase: Run Read-Only SQL Query for reads.

Supabase: Update Auth Config

supabase_update_auth_config

Update the project's auth settings. The endpoint accepts ~200 documented fields, so this node takes the JSON body directly.

Supabase: Update Branch Config

supabase_update_branch_config

Update a preview branch: rename it, relink its git branch, or change its persistence/review flags.

Supabase: Update Database Password

supabase_update_database_password

Rotate the project's Postgres password. Every client using the old connection string breaks until it is updated.

Supabase: Update PostgREST Config

supabase_update_postgrest_config

Update the Data API config. Changing db_schema changes which schemas are publicly exposed through PostgREST. Review carefully.

Supabase: Update Postgres Config

supabase_update_postgres_config

Update tunable Postgres parameters. Some parameters require a database restart, which briefly interrupts connections.

Supabase: Update Project

supabase_update_project

Rename a project. The Management API exposes only `name` on this endpoint.

Supabase: Update SSL Enforcement

supabase_update_ssl_enforcement

[Beta] Turn database SSL enforcement on or off. Turning it ON breaks any client connecting without SSL.

Supabase: Update Storage Config

supabase_update_storage_config

Update the project's Storage config (file size limit, feature toggles).

Using the integration

On the automation canvas

Supabase nodes chain with every other node: a failing health check can open an assigned task in Mattering Productivity, an advisor finding can be summarized by an AI step before anyone reads it, and a merged preview branch can post to a channel in the same flow.

From AI assistants over MCP

Every node speaks MCP, the open protocol for connecting AI assistants to tools. Claude, ChatGPT, and Matter can inspect projects, read schemas, query data, and manage branches and functions through the same nodes your workflows use.

Reaching table data without the Data API

Use [[Supabase: Get Database Context]] to list schemas and tables, then [[Supabase: Run Read-Only SQL Query]] for reads and [[Supabase: Run SQL Query]] for writes. If a flow genuinely needs PostgREST request semantics, [[Supabase: List API Keys]] with reveal set to true returns the project key and the platform's HTTP Request node can call your project host directly.

Working with preview branches

[[Supabase: Create Branch]] provisions a branch database, [[Supabase: Push Branch]] applies pending migrations and returns a workflow run id to poll, [[Supabase: Diff Branch]] returns the SQL difference against the parent, and [[Supabase: Merge Branch]] applies those migrations to the parent project. Review the diff before the merge: it changes the parent.

Handling the destructive nodes

Seven nodes are marked destructive in the palette: [[Supabase: Delete Project]], [[Supabase: Delete Branch]], [[Supabase: Reset Branch]], [[Supabase: Delete Secrets]], [[Supabase: Delete API Key]], [[Supabase: Delete Edge Function]], and [[Supabase: Run SQL Query]]. Keep them out of agent-triggered paths unless a human step approves the run, and prefer the read-only query node whenever a workflow only needs to read.

Troubleshooting

Every node returns 401 Unauthorized

The credential is not a valid Supabase personal access token. The most common cause is pasting a project API key (anon, service_role, publishable, or secret) instead: those come from a project's settings and only address that project's Data API. A personal access token comes from your account settings, is prefixed sbp_, and is the only credential the Management API accepts here. Generate a fresh one, update the credential, and re-run Supabase: List Organizations.

List Organizations works, but a project node returns 403 or not found

The token carries the permissions of the Supabase user who created it. If you are not a member of the organization that owns the project, or your organization role does not allow that action, Supabase refuses it. Run Supabase: List Organizations and Supabase: List Organization Members to confirm your membership and role, and ask an owner to raise it if the action needs a higher role.

A node fails because the project ref looks wrong

Nodes take the project ref, not the project name. The ref is the 20 character identifier in the dashboard URL for that project. Run Supabase: List Projects and copy the ref field from the response, then reference it from later nodes rather than typing it in each one.

You expected a Data API or Storage object call and there is no node for it

That is by design. The per-project Data API (PostgREST), Auth, Storage objects, and Realtime all live on your project host and use per-project keys, so they are outside this connector. Use Supabase: Run Read-Only SQL Query and Supabase: Run SQL Query for table data, and if you need PostgREST or Storage object semantics specifically, read the key with Supabase: List API Keys and call your project host from the platform's HTTP Request node.

Create Project or a branch node returns a plan, quota, or entitlement error

Supabase gates some actions by plan and by account limits. Free plan accounts cap how many active projects they can run, and preview branching is a paid plan feature. An error of that kind is Supabase declining the action for your plan, not a broken connector: read the message, and confirm on the organization's billing page before you retry.

Run SQL Query did something you did not intend

Run SQL Query executes whatever statement it is given with full privileges, so a DROP, DELETE, or TRUNCATE runs for real and is not reversible through the API. Use Supabase: Run Read-Only SQL Query for anything read-shaped, where writes are rejected by Postgres itself, and put a human approval step in front of the write node when an agent composes the SQL.

A node output contains keys, secrets, or a password

Three nodes return secret material by design: Supabase: List API Keys with reveal set to true, Supabase: List Secrets, and Supabase: Update Database Password. Do not route those outputs into task comments, messages, or saved artifacts, where they persist in plain sight. Wire them straight into the step that consumes them. Remember that rotating the database password breaks every client still using the old connection string until it is updated.

A response arrives under data.raw_body instead of parsed JSON

Some Management API endpoints return text rather than JSON. Supabase: Diff Branch returns SQL text, Supabase: Get Edge Function Body returns function source, and Supabase: Generate TypeScript Types returns a .ts file as a string. The connector surfaces non-JSON responses under data.raw_body, so read that field rather than expecting a parsed object.

Applying network restrictions locked you out of the database

Supabase: Apply Network Restrictions replaces the project's allow list rather than adding to it, so any CIDR range you leave out loses database access. Read the current state with Supabase: Get Network Restrictions first, then send the full intended list, including your own range, in the apply call.

The Supabase MCP

What connecting Supabase unlocks for AI agents and automations, with common uses and FAQs.

More guides

All Automations documentation

Every integration guide, plus how connectors, credentials, and workflows fit together.

Supabase is a trademark of its respective owner. Mattering uses platform names to identify the services these integrations connect to; no endorsement or affiliation is implied.