Docs · Connect your tools
Connect Supabase
StackWeaver reads, and never changes, one read-only endpoint on one of your own Supabase projects once a day, through a secret API key you already have. This guide says exactly what is read, which permission the key needs, how to find it, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver calls your project's own Data API root with the project ref and secret key you paste. The result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including a result that fails.
| Check (as shown in the portal) | What it looks at |
|---|---|
| API key valid and reachable | Whether the stored secret key is accepted and the project's Data API root responds. Evidence only: no threshold is applied. |
2. What it does not do
- It never reads a table's rows or any application data. The one check reads only the Data API's own root description, never a row you have stored.
- It cannot change anything: the key is used for one read-only endpoint.
- It does not say your database security posture meets any requirement. A result is what Supabase returned at a certain time.
- It needs a project-scoped secret key (starting `sb_secret_`), not an account-wide personal access token (starting `sbp_`) — those are different credentials for different APIs, and only the project-scoped secret key works here.
3. The access it needs
Two values: your project's ref (a plain, non-secret id visible in your dashboard URL) and its secret API key, sent as the `apikey` header — never `Authorization: Bearer` — on every request (Supabase).
Who can connect. In StackWeaver, a workspace owner or admin pastes the project ref and key. Keep this key only as exposed as this one read-only check needs.
4. Connect steps
- In your Supabase project dashboard, open Project Settings → API and copy the project's secret key and its project ref (the 20-character id also visible in the dashboard URL).
- In StackWeaver, open Evidence, the Supabase section, and paste the project ref and secret key.
- Press Test connection.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check, or the feature needs a plan StackWeaver could not confirm |
| Could not check | StackWeaver could not read the data, or the check needs a higher plan than the account has |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Supabase section. StackWeaver deletes the stored key.
- In your Supabase project's API settings, rotate the secret key yourself — StackWeaver has no way to ask Supabase to revoke a key on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| Supabase refused the key: it may be wrong, revoked, or for a different project | Check the project ref matches the key's own project, and that you pasted the secret key (`sb_secret_...`) rather than a personal access token (`sbp_...`) |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.