Supabase is an open-source BaaS that provides a PostgreSQL database with built-in authentication, storage, and real-time APIs. It’s designed to help developers quickly build and scale applications without managing backend infrastructure.
Required Permissions
A Supabase account that is an Owner or Administrator of the organization that owns the project you want to connect.
Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.
How to Connect
In Scytale, go to 'Integrations'.
Search for Supabase and select 'Connect'.
Paste your project ID, API key & access token.
Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.
You have now successfully connected to Supabase.
How to Generate Credentials in Supabase
Log in to your Supabase dashboard.
If you belong to more than one organization, use the organization switcher at the top left to select the organization you want Scytale to monitor.
Select the project you want to connect.
In the left sidebar, select 'Project Settings' and stay on the 'General settings' page.
Find Project ID, labelled "Reference used in APIs and URLs". It is a 20-character lowercase string, for example abcdefghijklmnopqrst.
Click Copy and save it to your scratch note.
You can also read it out of the browser address bar: in https://supabase.com/dashboard/project/abcdefghijklmnopqrst/... the Project ID is the part after /project/.
In the same 'Settings' menu, select 'API Keys'.
Stay on the 'Publishable and secret API keys' tab — not the 'Legacy anon, service_role API keys' tab.
Scroll to the Secret keys section, where your project already has a key named 'default'.
Either reveal and copy that one (the eye icon, then the copy icon), or click + New secret key and name it Scytale to keep Scytale's access separate from anything else using the default key. The value starts with sb_secret_. Save it to your scratch note.
Ignore the Publishable key section above it — that key is safe to share publicly and is not what Scytale needs.ֿ
Click your avatar at the top right, then Account settings — or go straight to supabase.com/dashboard/account/tokens.
Open Access Tokens.
Click Generate new token.
Name it Scytale.
Change "Expires in" — do not leave the default. It is set to 30 days, and 30 days is also the longest preset on the list. Choose Custom and set a date as far ahead as your security policy allows. Whatever date you pick is the date Scytale stops collecting evidence.
Click Generate token.
Copy the token immediately. It starts with sbp_ and Supabase will not show it again.
