Supabase project-scoped access tokens cannot access the account-level /v1/projects endpoint. As a result, creating or updating a Supabase App Connection with a project-scoped token fails credential validation with a 403 response.
This PR adds support for project-scoped tokens by allowing users to provide the Supabase Project Reference.
When projectRef is provided, credential validation uses the project-scoped secrets endpoint:
/v1/projects/{projectRef}/secrets
Existing account-scoped tokens continue to use the existing project discovery flow.
I had a chance to take a look at your PR, and it is actually already possible to create and use project-scoped tokens without any changes needed to the App Connection.
When you create a Supabase access token inside Supabase, you can give it access to to the list projects endpoint. I’ve attached a screenshot of the permission you need to assign to the project-scoped Supabase access token in order for it to work with Infiscial.
Thanks for explaining this, Daniel! I picked this up because of the existing issue #8450, where project-scoped Supabase tokens fail during credential validation. I thought supporting the project-specific endpoint would be a straightforward way to address it, especially since the issue also mentioned manually providing the project ref as a possible solution.
I see your point about granting Projects: Read permission to make the existing flow work. If that’s the intended way to handle this with Supabase, I understand why keeping the existing flow would make more sense.
