supabase-automation

name	supabase-automation
description	Master Supabase CLI automation, auth configuration, edge functions, secrets management, MCP integration, and Management API for production deployments

Supabase Automation & Integration Expert

Complete automation toolkit for Supabase CLI, auth configuration, edge functions, secrets, MCP integration, and API management.

MCP Integration

Supabase MCP Server provides Model Context Protocol integration for:

• Docs - Access Supabase documentation
• Account - Manage account and projects
• Database - Query and manage database
• Debugging - Debug edge functions and queries
• Development - Local development tools
• Functions - Manage edge functions
• Branching - Database branching (preview environments)
• Storage - File storage management

MCP Connection URL:

https://mcp.supabase.com/mcp?project_ref=spdtwktxdalcfigzeqrz&features=docs%2Caccount%2Cdatabase%2Cdebugging%2Cdevelopment%2Cfunctions%2Cbranching%2Cstorage

Setup MCP Server:

# Add to Claude Desktop config (~/.config/claude/claude_desktop_config.json)
{
  "mcpServers": {
    "supabase": {
      "url": "https://mcp.supabase.com/mcp",
      "params": {
        "project_ref": "spdtwktxdalcfigzeqrz",
        "features": "docs,account,database,debugging,development,functions,branching,storage"
      },
      "env": {
        "SUPABASE_ACCESS_TOKEN": "${SUPABASE_ACCESS_TOKEN}",
        "SUPABASE_ANON_KEY": "${SUPABASE_ANON_KEY}",
        "SUPABASE_SERVICE_ROLE_KEY": "${SUPABASE_SERVICE_ROLE_KEY}"
      }
    }
  }
}

Core Capabilities

1. CLI Automation

• Project initialization and configuration
• Local development setup
• Database migrations and seeding
• Type generation for TypeScript
• Database schema management
• Automated deployments

2. Auth Configuration

• Site URL and redirect URL management
• OAuth provider setup (Google, GitHub, etc.)
• Email/password authentication
• Magic links and OTP
• JWT configuration
• Row Level Security (RLS) policies

3. Edge Functions

• Function creation and deployment
• Deno runtime configuration
• Secrets injection
• CORS configuration
• Function invocation and testing
• Local development server

4. Secrets Management

• Environment variable management
• Secret storage via Supabase CLI
• Vault integration
• Secret rotation
• Secure credential handling

5. Management API

• Project configuration via API
• Database connection pooling
• API key management
• Usage monitoring
• Automated backups
• SSL configuration

Documentation References

Essential Reading:

• API Reference
• CLI Reference
• Local Development
• Deployment Guide

Quick Start Examples

1. Initialize Local Development

# Initialize Supabase in project
supabase init

# Start local Supabase (Docker required)
supabase start

# Generate TypeScript types
supabase gen types typescript --local > types/supabase.ts

# View local dashboard
# Studio: http://localhost:54323
# API URL: http://localhost:54321

2. Configure Auth URLs

# Set site URL (production)
supabase secrets set SITE_URL=https://app.insightpulseai.net

# Add redirect URLs via Dashboard or Management API
curl -X POST 'https://api.supabase.com/v1/projects/{project-ref}/config' \
  -H "Authorization: Bearer ${SUPABASE_ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "auth": {
      "site_url": "https://app.insightpulseai.net",
      "redirect_urls": [
        "https://app.insightpulseai.net/auth/callback",
        "https://*.insightpulseai.net/auth/callback",
        "http://localhost:3000/auth/callback"
      ]
    }
  }'

3. Deploy Edge Functions

# Create new edge function
supabase functions new my-function

# Write function code
cat > supabase/functions/my-function/index.ts << 'EOF'
import { serve } from "https://deno.land/std@0.168.0/http/server.ts"
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

serve(async (req) => {
  const supabase = createClient(
    Deno.env.get('SUPABASE_URL') ?? '',
    Deno.env.get('SUPABASE_ANON_KEY') ?? ''
  )

  // Your function logic here
  const { data, error } = await supabase.from('table').select('*')

  return new Response(
    JSON.stringify({ data, error }),
    { headers: { "Content-Type": "application/json" } }
  )
})
EOF

# Set secrets for edge function
supabase secrets set API_KEY=your_secret_key
supabase secrets set OPENAI_API_KEY=sk-...

# Deploy edge function
supabase functions deploy my-function

# Invoke function
curl -X POST 'https://{project-ref}.supabase.co/functions/v1/my-function' \
  -H "Authorization: Bearer ${SUPABASE_ANON_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"param": "value"}'

4. Database Migrations

# Create new migration
supabase migration new create_users_table

# Edit migration file
cat > supabase/migrations/20250101_create_users_table.sql << 'EOF'
-- Create users table with RLS
CREATE TABLE public.users (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  email TEXT UNIQUE NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

-- Enable RLS
ALTER TABLE public.users ENABLE ROW LEVEL SECURITY;

-- Policy: Users can read their own data
CREATE POLICY "Users can view own data"
  ON public.users
  FOR SELECT
  USING (auth.uid() = id);

-- Grant permissions
GRANT SELECT, INSERT, UPDATE ON public.users TO authenticated;
EOF

# Apply migrations locally
supabase db reset

# Push to production
supabase db push

5. Secrets Management

# List all secrets
supabase secrets list

# Set secret
supabase secrets set DATABASE_URL=postgresql://...
supabase secrets set STRIPE_SECRET_KEY=sk_live_...
supabase secrets set OPENAI_API_KEY=sk-...

# Unset secret
supabase secrets unset OLD_SECRET

# Use secrets in edge functions
# Automatically available as Deno.env.get('SECRET_NAME')

6. Management API - Full Configuration

// supabase-management.ts
const SUPABASE_ACCESS_TOKEN = process.env.SUPABASE_ACCESS_TOKEN
const PROJECT_REF = 'your-project-ref'
const API_BASE = 'https://api.supabase.com/v1'

// Configure auth settings
async function configureAuth() {
  const response = await fetch(`${API_BASE}/projects/${PROJECT_REF}/config`, {
    method: 'PATCH',
    headers: {
      'Authorization': `Bearer ${SUPABASE_ACCESS_TOKEN}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      auth: {
        site_url: 'https://app.insightpulseai.net',
        redirect_urls: [
          'https://app.insightpulseai.net/auth/callback',
          'https://*.insightpulseai.net/auth/callback',
          'http://localhost:3000/auth/callback'
        ],
        external_google_enabled: true,
        external_github_enabled: true,
        jwt_exp: 3600,
        refresh_token_rotation_enabled: true,
        security_refresh_token_reuse_interval: 10
      }
    })
  })
  return response.json()
}

// Configure database pooling
async function configureDatabasePooling() {
  const response = await fetch(`${API_BASE}/projects/${PROJECT_REF}/database/pooling`, {
    method: 'PATCH',
    headers: {
      'Authorization': `Bearer ${SUPABASE_ACCESS_TOKEN}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      pool_mode: 'transaction',
      default_pool_size: 15,
      ignore_startup_parameters: 'extra_float_digits'
    })
  })
  return response.json()
}

Common Workflows

Workflow 1: New Project Setup

# 1. Initialize project
supabase init
supabase login

# 2. Link to remote project
supabase link --project-ref {project-ref}

# 3. Pull remote schema
supabase db pull

# 4. Generate types
supabase gen types typescript --linked > types/supabase.ts

# 5. Start local development
supabase start

Workflow 2: Deploy with CI/CD

# .github/workflows/deploy-supabase.yml
name: Deploy Supabase

on:
  push:
    branches: [main]
    paths:
      - 'supabase/**'

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Supabase CLI
        uses: supabase/setup-cli@v1
        with:
          version: latest

      - name: Link Supabase project
        run: supabase link --project-ref ${{ secrets.SUPABASE_PROJECT_REF }}
        env:
          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}

      - name: Push database migrations
        run: supabase db push

      - name: Deploy edge functions
        run: |
          supabase functions deploy --no-verify-jwt
        env:
          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}

      - name: Set production secrets
        run: |
          supabase secrets set OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
          supabase secrets set STRIPE_SECRET_KEY=${{ secrets.STRIPE_SECRET_KEY }}

Workflow 3: Auth Provider Setup

// Setup Google OAuth
// 1. Get credentials from Google Cloud Console
// 2. Configure in Supabase Dashboard or via API

const setupGoogleAuth = async () => {
  const response = await fetch(
    `https://api.supabase.com/v1/projects/${PROJECT_REF}/config`,
    {
      method: 'PATCH',
      headers: {
        'Authorization': `Bearer ${SUPABASE_ACCESS_TOKEN}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        auth: {
          external_google_enabled: true,
          external_google_client_id: 'your-google-client-id.apps.googleusercontent.com',
          external_google_secret: 'GOCSPX-...'
        }
      })
    }
  )
  return response.json()
}

// Use in your app
const { data, error } = await supabase.auth.signInWithOAuth({
  provider: 'google',
  options: {
    redirectTo: 'https://app.insightpulseai.net/auth/callback'
  }
})

MCP-Powered Workflows

MCP Workflow 1: Database Branching for Testing

# Using MCP to create database branch for feature testing
# MCP command: create_database_branch

# Create branch from production
supabase branches create feature-trial-balance --project-ref spdtwktxdalcfigzeqrz

# Get branch connection string
supabase branches get feature-trial-balance --project-ref spdtwktxdalcfigzeqrz

# Run migrations on branch
supabase db push --branch feature-trial-balance

# Test your changes
# Connect app to branch URL temporarily

# Merge branch when ready
supabase branches merge feature-trial-balance --project-ref spdtwktxdalcfigzeqrz

MCP Workflow 2: Edge Function Debugging

// Use MCP debugging features to troubleshoot edge functions

// Enable verbose logging in edge function
import { serve } from "https://deno.land/std@0.168.0/http/server.ts"

serve(async (req) => {
  console.log('[DEBUG] Request received:', {
    method: req.method,
    url: req.url,
    headers: Object.fromEntries(req.headers)
  })

  try {
    // Your function logic
    const result = await processRequest(req)
    console.log('[DEBUG] Processing successful:', result)
    return new Response(JSON.stringify(result))
  } catch (error) {
    console.error('[ERROR] Function failed:', error)
    return new Response(JSON.stringify({ error: error.message }), {
      status: 500
    })
  }
})

// Check logs via MCP or CLI
// supabase functions logs my-function --project-ref spdtwktxdalcfigzeqrz

MCP Workflow 3: Storage Management

// Using MCP storage features for BIR document management

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  process.env.SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!
)

// Create storage bucket for BIR forms
const { data: bucket, error: bucketError } = await supabase
  .storage
  .createBucket('bir-forms', {
    public: false,
    fileSizeLimit: 52428800, // 50MB
    allowedMimeTypes: ['application/pdf', 'image/png', 'image/jpeg']
  })

// Upload BIR form with RLS
const { data, error } = await supabase
  .storage
  .from('bir-forms')
  .upload(