---
title: "Supabase integration for LuumenAI"
url: "https://www.luumen.ai/integrations/supabase/"
entity: SoftwareIntegration
category: "Databases & data platforms"
audience: "SRE, DevOps, platform engineering, IT operations"
---

# Supabase integration for LuumenAI

Read Supabase project config and database state, then change it with approval

## What LuumenAI can do with Supabase

LuumenAI connects to Supabase with an API token and exposes 124 tools (61 read-only · 41 write · 22 destructive). Reads answer immediately; writes are shown as a plan and require approval by default, configurable per tool by an administrator.

## Key facts

- Authentication: API token
- Tools available: 124 tools (61 read-only · 41 write · 22 destructive)
- Plan: available on all plans
- Category: Databases & data platforms

## About Supabase with LuumenAI

Connect Supabase and your agent can read project state directly: network bans and IP restrictions, SSL enforcement, custom hostname and vanity subdomain config, third-party auth providers, and generated TypeScript types. Changes — migrations, API keys, read replicas, lifting network bans — are previewed, approved, and recorded. Luumen authenticates with an API key.

## Example tools

Read-only (61 in total):

- `SUPABASE_ALPHA_GET_THIRD_PARTY_INTEGRATION` — Retrieves the detailed configuration for a specific third-party authentication (TPA) provider, identified by `tpa_id`, within an existing Supabase project specified by `ref`.
- `SUPABASE_ALPHA_LIST_THIRD_PARTY_AUTH_INTEGRATIONS` — Lists all configured third-party authentication provider integrations for an existing Supabase project (using its `ref`), suitable for read-only auditing or verifying current authentication settings.
- `SUPABASE_BETA_AUTHORIZE_USER_THROUGH_OAUTH` — Generates a Supabase OAuth 2.0 authorization URL for user redirection.
- `SUPABASE_BETA_CHECK_VANITY_SUBDOMAIN_AVAILABILITY` — Checks if a specific vanity subdomain is available for a Supabase project; this action does not reserve or assign the subdomain.
- `SUPABASE_BETA_GET_PROJECT_CUSTOM_HOSTNAME_CONFIG` — Retrieves a Supabase project's custom hostname configuration, including its status, SSL certificate, and ownership verification, noting that availability may depend on the project's plan.
- `SUPABASE_BETA_GET_PROJECT_NETWORK_BANS` — Retrieves the list of banned IPv4 addresses for a Supabase project using its unique project reference string; this is a read-only operation.
- `SUPABASE_BETA_GET_PROJECT_NETWORK_RESTRICTIONS` — Retrieves the network restriction settings (IP allowlists) for a Supabase project.
- `SUPABASE_BETA_GET_PROJECT_PGSODIUM_CONFIG` — Retrieves the PGSodium configuration, including the root encryption key, for an existing Supabase project identified by its `ref`.

Write and destructive (63 in total, approval required by default):

- `SUPABASE_ALPHA_CREATE_API_KEY` — Creates a 'publishable' or 'secret' API key for an existing Supabase project, optionally with a description; 'secret' keys can have customized JWT templates.
- `SUPABASE_ALPHA_DELETE_API_KEY` — Permanently deletes a specific API key (identified by `id`) from a Supabase project (identified by `ref`), revoking its access.
- `SUPABASE_ALPHA_DELETE_THIRD_PARTY_AUTH_INTEGRATION` — Removes a third-party authentication provider (e.g., Google, GitHub) from a Supabase project's configuration; this immediately prevents users from logging in via that method.
- `SUPABASE_ALPHA_UPDATE_API_KEY` — Updates an existing Supabase project API key's `description` and/or `secret_jwt_template` (which defines its `role`); does not regenerate the key string.
- `SUPABASE_APPLY_A_MIGRATION` — Apply database migrations to a Supabase project.
- `SUPABASE_BETA_ACTIVATE_CUSTOM_HOSTNAME` — Activates a previously configured custom hostname for a Supabase project, assuming DNS settings are verified externally.
- `SUPABASE_BETA_ACTIVATE_VANITY_SUBDOMAIN` — Activates a vanity subdomain for the specified Supabase project (e.g., 'my-brand.supabase.co').
- `SUPABASE_BETA_CREATE_READ_REPLICA` — Provisions a read-only replica for a Supabase project in a specified, Supabase-supported AWS region to enhance read performance and reduce latency.

## Frequently asked questions

### How does LuumenAI connect to Supabase?

Authorize once with API token. Luumen lists the scopes each action needs before you approve the connection, and credentials never appear in the chat.

### Can LuumenAI change things in Supabase on its own?

Read actions answer immediately. Anything that writes is shown as a plan and requires approval by default, including the 22 actions classified as destructive. Administrators configure that per tool.

### Is there an audit trail?

Every call to Supabase — read or write, approved or declined — is recorded with the actor, the input, and the result.

Full page: https://www.luumen.ai/integrations/supabase/