Prowler for Supabase authenticates to the hosted Supabase Management API using a Personal Access Token (PAT). Prowler reads the token exclusively from SUPABASE_ACCESS_TOKEN; there is no credential CLI argument, and Prowler does not read Supabase CLI state files.
Personal Access Token Security
Supabase PATs inherit the privileges of the user account that created them. Use a dedicated least-privilege or read-only organization account where available, set a suitable token expiry, store the token in a secret manager, and rotate it regularly.
A PAT is not independently scoped to read-only Management API access. Compromise of the token grants the same Management API privileges as its issuing user account.
Required Access
The issuing account must be able to call:
An invalid token returns 401, insufficient organization permissions return 403, and rate limiting returns 429. Prowler treats all three as scan errors rather than compliant results. Supabase applies a standard limit of approximately 120 Management API requests per minute for each user and scope; Prowler uses the response rate-limit reset headers before retrying.
Create a PAT from Supabase Account Tokens, then export it:
For CI/CD, configure SUPABASE_ACCESS_TOKEN as a masked secret environment variable. Do not place it in command arguments, repository files, or job logs.
Out of Scope
This proof of concept does not support:
- OAuth 2.0 Authorization Code with Proof Key for Code Exchange (PKCE)
- Direct PostgreSQL authentication
- Self-hosted Supabase deployments
- Supabase CLI credential or state files
About Us