Temporary access

Your Supabase project supports connecting to the Postgres database using either your Supabase API token (Personal Access Token) or your current dashboard session token (JWT). This is called temporary access, as the authentication tokens can be short-lived and tied directly to a specific Supabase user. Temporary access is disabled by default.

Enabling temporary access only applies to connections to Postgres and the shared pooler (Supavisor); all HTTP APIs offered by Supabase (e.g., PostgREST, Storage, Auth) require authentication tokens specific to the service and are independent of the Supabase platform user(s).

Manage temporary access via the dashboard#

The easiest way to manage temporary access is via the "Enable temporary access" settings section in Database Settings page of the dashboard.

Manage temporary access via the Management API#

You can also manage temporary access using the Management API:

1
# Get your access token from https://supabase.com/dashboard/account/tokens
2
export SUPABASE_MANAGEMENT_API_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Get current temporary access status
6
curl -X GET "https://api.supabase.com/v1/projects/$PROJECT_REF/jit-access" \
7
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN"
8
9
# Enable temporary access
10
curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/jit-access" \
11
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
12
  -H "Content-Type: application/json" \
13
  -d '{
14
    "state":"enabled"
15
  }'
16
17
# Disable temporary access
18
curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/jit-access" \
19
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
20
  -H "Content-Type: application/json" \
21
  -d '{
22
    "state":"disabled"
23
  }'

Configure user access#

After you enable temporary access, map each team member to the Postgres roles they can assume. You can also limit each role by expiry and by network. For more information, see Map team members to Postgres roles.

Using temporary access#

To log in to the database using temporary access, existing connection strings can be used and only the password needs to be changed to the user's API or dashboard token.

For example, if a user has been authorized to assume the postgres role:

1
psql 'postgres://postgres:sbp_111222333aaabbbccc@db.{project-ref}.supabase.co/postgres'

Since Supabase API tokens can be used, it is also possible to generate API tokens for services you don't want to share your Postgres role password with (for example a GitHub Action). The API token can be configured with an expiry time and temporary access-specific restrictions can also be applied.

Connecting via the shared connection pooler requires the addition of a new connection option. This can be applied either directly in the connection URI or as conninfo (easier to read):

1
# directly in the URI
2
psql 'postgres://postgres.{project-ref}:sbp_111222333aaabbbccc@aws-1-us-west-1.pooler.supabase.com:5432/postgres?options=-c%20jit%3dtrue'
3
4
# or as a connection info string
5
psql "host=aws-1-us-west-1.pooler.supabase.com user=postgres.{project-ref} options='-c jit=true'"