# Support Supabase project-scoped access tokens- (#8527 )

**URL:** <https://community.infisical.com/t/support-supabase-project-scoped-access-tokens-8527/73>\
**Category:** Contributing\
**Created:** [October 9, 2026, 1:05pm UTC](https://community.infisical.com/t/support-supabase-project-scoped-access-tokens-8527/73 "2026-10-09T13:05:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gaurang2456](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/gaurang2456/32/108_2.png) [@gaurang2456](https://community.infisical.com/u/gaurang2456)\
**Post date:** [October 9, 2026, 1:05pm UTC](https://community.infisical.com/t/support-supabase-project-scoped-access-tokens-8527/73/1 "2026-10-09T13:05:16Z")

</div>

Supabase project-scoped access tokens cannot access the account-level `/v1/projects` endpoint. As a result, creating or updating a Supabase App Connection with a project-scoped token fails credential validation with a 403 response.

This PR adds support for project-scoped tokens by allowing users to provide the Supabase Project Reference.

When `projectRef` is provided, credential validation uses the project-scoped secrets endpoint:

`/v1/projects/{projectRef}/secrets`

Existing account-scoped tokens continue to use the existing project discovery flow.

Fixes #8450

[Here is my PR (#8527), review it](https://github.com/Infisical/infisical/pull/8527)

---

<div class="post-metadata">

**Author:** ![daniel](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/daniel/32/20_2.png) [@daniel](https://community.infisical.com/u/daniel)\
**Post date:** [October 9, 2026, 2:07pm UTC](https://community.infisical.com/t/support-supabase-project-scoped-access-tokens-8527/73/2 "2026-10-09T14:07:30Z")

</div>

Hi @gaurang2456, thank you for raising this!

I had a chance to take a look at your PR, and it is actually already possible to create and use project-scoped tokens without any changes needed to the App Connection.

When you create a Supabase access token inside Supabase, you can give it access to to the list projects endpoint. I’ve attached a screenshot of the permission you need to assign to the project-scoped Supabase access token in order for it to work with Infiscial.

Thank you!

 ![CleanShot 2026-10-09 at 18.03.30@2x](https://canada1.discourse-cdn.com/flex048/uploads/infisical1/original/1X/5ef00d254f3ccccba4dc45a40743e790c755ffc4.png)

---

<div class="post-metadata">

**Author:** ![gaurang2456](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/gaurang2456/32/108_2.png) [@gaurang2456](https://community.infisical.com/u/gaurang2456)\
**Post date:** [October 10, 2026, 8:45am UTC](https://community.infisical.com/t/support-supabase-project-scoped-access-tokens-8527/73/3 "2026-10-10T08:45:19Z")

</div>

Thanks for explaining this, Daniel! I picked this up because of the existing issue #8450, where project-scoped Supabase tokens fail during credential validation. I thought supporting the project-specific endpoint would be a straightforward way to address it, especially since the issue also mentioned manually providing the project ref as a possible solution.

I see your point about granting Projects: Read permission to make the existing flow work. If that’s the intended way to handle this with Supabase, I understand why keeping the existing flow would make more sense.