--- title: Scope your Personal Access Tokens | daily.dev description: Supabase Personal Access Tokens can now be scoped to specific organizations, projects, and permissions instead of granting full account access. Token scoping... canonical: https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Scope your Personal Access Tokens | daily.dev og:description: Supabase Personal Access Tokens can now be scoped to specific organizations, projects, and permissions instead of granting full account access. Token scoping... og:url: https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t og:image: https://api.daily.dev/og/posts/UlhF5H34t.png og:image:alt: Scope your Personal Access Tokens og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Scope your Personal Access Tokens **[Supabase](https://daily.dev/sources/supabase)** · 5 min read · 2 upvotes · 1 comments ## Summary Supabase Personal Access Tokens can now be scoped to specific organizations, projects, and permissions instead of granting full account access. Token scoping became generally available on September 28 and was announced at Supabase Select on October 2. Every token created in the Dashboard is now scoped by default, and nearly nine out of 10 tokens created since launch have been scoped. Scoped tokens start with the prefix 'sbp_fc', support expirations up to one year, and work with the Management API, MCP server, and CLI. Existing full-access tokens still work and are marked 'Legacy' in the Dashboard. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I limit a Supabase Personal Access Token to just one project with read-only database access? In the Supabase Dashboard's access tokens page, choose the single project as the resource scope, select the 'No access' permission preset, then toggle 'Database' to read-only. Avoid the 'Read-only' preset since it also exposes secrets like API keys. Review the blast radius screen before creating, which shows the exact Management API endpoints and MCP tools covered. _Tightening token scopes for CI and agent access is easier to track with daily.dev's developer updates._ ### What prefix do scoped Supabase Personal Access Tokens use, and how is that different from legacy tokens? A scoped Supabase Personal Access Token starts with the prefix 'sbp_fc' and uses standard bearer authentication in existing workflows. Tokens created with full account access, not limited by scope, are labeled 'Legacy' in the Dashboard. Existing legacy tokens keep working with no deprecation or shutoff date, and a 'Create legacy token' option remains available. _Developers auditing token permissions across integrations can follow ecosystem changes like this on daily.dev._ ### Does the Supabase CLI login flow create scoped tokens? Not yet: the browser flow of 'supabase login' still creates a token with full account access. Supabase is updating it to create a scoped token instead, but until then developers should create the token in the Dashboard and pass it using 'supabase login --token', or set the SUPABASE_ACCESS_TOKEN environment variable for CI environments. _Teams wiring up CI pipelines can track CLI changes like this on daily.dev before they ship._ ## Community discussion Top comments from developers on daily.dev. **@heyvaldemar** · 0 upvotes > Scoped tokens have one trap to test before trusting them: what the API answers when a scope is missing. GitHub answers `404`, not `403`, when a fine-grained token lacks the Pull requests permission, the same answer as a repository that does not exist, so a watcher that reads 404 as "nothing there" reports clean. > > In the fleet I run, a job that could not read eleven private repositories got a second token with one permission, pull requests read-only, instead of a wider first one. A 404 is then checked against the repository itself, so "cannot see" and "is not there" stop looking the same. ## Similar posts on daily.dev - [Project-scoped Tokens](https://daily.dev/posts/project-scoped-tokens-dcz6uakob) · Vercel · 0 upvotes · 0 comments - [Limit token exposure with fine-grained PATs](https://daily.dev/posts/limit-token-exposure-with-fine-grained-pats-eceamdfew) · GitLab · 0 upvotes · 0 comments - [Modernize Datadog API authentication with scoped credentials](https://daily.dev/posts/modernize-datadog-api-authentication-with-scoped-credentials-hqg9vowte) · Datadog · 0 upvotes · 0 comments - [Enforce Access Token Expiry Policies in Pulumi Cloud](https://daily.dev/posts/enforce-access-token-expiry-policies-in-pulumi-cloud-mij0qyjhx) · Pulumi · 0 upvotes · 0 comments - [Build "Sign in with Your App" using Supabase Auth](https://daily.dev/posts/build-sign-in-with-your-app-using-supabase-auth-u1r7btb2y) · Supabase · 5 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mcp](https://daily.dev/tags/mcp), [#authorization](https://daily.dev/tags/authorization), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Scope your Personal Access Tokens","url":"https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t"},"datePublished":"2026-10-26T20:09:23.687Z","dateModified":"2026-10-26T20:23:21.951Z","description":"Supabase Personal Access Tokens can now be scoped to specific organizations, projects, and permissions instead of granting full account access. Token scoping...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9c6704578c6998ae3e12e5777e5049b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9c6704578c6998ae3e12e5777e5049b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Supabase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Supabase","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/d0aa77cfb88d44dd8e6d5cd02fdf80bd","url":"https://daily.dev/sources/supabase"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,mcp,authorization,supabase","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Supabase","item":"https://daily.dev/sources/supabase"},{"@type":"ListItem","position":3,"name":"Scope your Personal Access Tokens"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t","comment":[{"@type":"Comment","text":"Scoped tokens have one trap to test before trusting them: what the API answers when a scope is missing. GitHub answers 404, not 403, when a fine-grained token lacks the Pull requests permission, the same answer as a repository that does not exist, so a watcher that reads 404 as “nothing there” reports clean.\nIn the fleet I run, a job that could not read eleven private repositories got a second token with one permission, pull requests read-only, instead of a wider first one. A 404 is then checked against the repository itself, so “cannot see” and “is not there” stop looking the same.","datePublished":"2026-10-27T02:27:16.781Z","url":"https://daily.dev/posts/UlhF5H34t#c-cPDtr97gZ","author":{"@type":"Person","name":"Vladimir Mikhalev","url":"https://daily.dev/heyvaldemar","image":"https://media.daily.dev/image/upload/s--hNY2yBbX--/f_auto/v1768758611/avatars/avatar_ft0iS8AcGd90jdHVINKGp?_a=BAMAMiiu0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/scope-your-personal-access-tokens-ulhf5h34t#faq","mainEntity":[{"@type":"Question","name":"How do I limit a Supabase Personal Access Token to just one project with read-only database access?","acceptedAnswer":{"@type":"Answer","text":"In the Supabase Dashboard's access tokens page, choose the single project as the resource scope, select the 'No access' permission preset, then toggle 'Database' to read-only. Avoid the 'Read-only' preset since it also exposes secrets like API keys. Review the blast radius screen before creating, which shows the exact Management API endpoints and MCP tools covered. Tightening token scopes for CI and agent access is easier to track with daily.dev's developer updates."}},{"@type":"Question","name":"What prefix do scoped Supabase Personal Access Tokens use, and how is that different from legacy tokens?","acceptedAnswer":{"@type":"Answer","text":"A scoped Supabase Personal Access Token starts with the prefix 'sbp_fc' and uses standard bearer authentication in existing workflows. Tokens created with full account access, not limited by scope, are labeled 'Legacy' in the Dashboard. Existing legacy tokens keep working with no deprecation or shutoff date, and a 'Create legacy token' option remains available. Developers auditing token permissions across integrations can follow ecosystem changes like this on daily.dev."}},{"@type":"Question","name":"Does the Supabase CLI login flow create scoped tokens?","acceptedAnswer":{"@type":"Answer","text":"Not yet: the browser flow of 'supabase login' still creates a token with full account access. Supabase is updating it to create a scoped token instead, but until then developers should create the token in the Dashboard and pass it using 'supabase login --token', or set the SUPABASE_ACCESS_TOKEN environment variable for CI environments. Teams wiring up CI pipelines can track CLI changes like this on daily.dev before they ship."}}]} ```