Connect your Supabase account

CostAssured reads your Supabase organisation's projects, their compute size, disk, add-ons and branches, and a week of API request counts. It writes nothing. This guide takes about five minutes and needs somebody who is a member of the organisation you want to connect.

1. Create a scoped token, not a full-access one

Supabase issues two kinds of personal access token:

• Scoped tokens are limited to the organisations, projects and permissions you choose, with Read or Read-write set per permission. Their value starts with sbp_fc. This is the only kind CostAssured accepts.
• Full-access tokens (shown with a Legacy badge in the dashboard) can do anything your account can do. CostAssured refuses them, before making a single call, because holding a token that could change your projects is a liability for both of us.

2. Choose the permissions

In the dashboard, open Account > Access Tokens and generate a new token.

1. Name it costassured, so every call reads clearly in your logs.
2. Limit it to one organisation: the one you want CostAssured to read. A token that can see two organisations is refused; connect each organisation separately.
3. Choose the projects: all of the organisation's projects, or the ones you want covered. A project the organisation lists but the token cannot read is still named in the report, with a note that its add-ons and traffic could not be read, and CostAssured proposes no low-risk change for it.
4. Set an expiry your organisation is happy to rotate on, and put the rotation in the calendar.
5. Under Permissions, keep the preset on Custom, so everything starts at None. Open each group below and set these permissions to Read, and nothing else. Leave the Database and Application services groups at None.

With all seven, the picker shows 1 configured under Project and 3 configured under each of the other two groups; with only the required three, 1 under Infrastructure and delivery and 2 under Account and organization. Without an optional permission the scan still runs, and the report says what it left out.

1. Copy the token immediately. Supabase shows it once.
2. Check it. Back in Account > Access Tokens, choose View access on the token. Supabase's own risk assessment should say Low risk, with Read on every capability (Read on 3 capabilities for the required set, up to 7 with the optional ones), across one organisation. If it says High risk or lists any Read-write capability, delete the token and create it again with every permission set to Read.

3. What CostAssured calls

Reads only. These are the only Management API endpoints CostAssured calls, all with GET:

Nothing else. No database content, no table data, no API keys or secrets, no Edge Function code, no logs, and no write of any kind.

4. Why read only cannot be confirmed

Supabase lets you create a token with Read permissions only, and this guide asks you to. But Supabase does not let a token report its own permissions, and the only other way to find out whether a token can write would be to try a write. CostAssured never does that, not even as a test.

So CostAssured cannot confirm that your token is read only, and it does not claim to. Every connection records that the token's scoping could not be confirmed, and the connect screen says so after the checks run. What CostAssured can do is be specific: it calls only the read endpoints listed in step 3, and the permissions table in step 2 is the whole of what it needs.

5. Paste it into CostAssured

Paste the token into the connect form and tick the box confirming that every permission on it is set to Read, which is what View access showed you in step 7 of section 2. CostAssured cannot see a token's permissions, so it asks you to confirm them, and keeps that confirmation with the connection. It then checks the token's kind, runs one read per capability and shows you the result before storing anything.

• Organizations and Organization Projects must pass. Without them there is nothing to estimate.
• Add-ons is required whenever the organisation has projects. It is checked against the first project at connect time and again on every scan. Without it no log drain or custom domain can be seen, so every change is raised to medium risk and no project is listed as protected.
• The rest are advisory. If one is refused the scan still runs, and the report names what it skipped.
• A refusal is a permission fact, not a mistake you made. CostAssured tells you which read was refused and which permission to add. A timeout says nothing about permission and is reported as what it is: a call that did not come back.

Tokens are stored encrypted and are decrypted only inside scan workers, never in a browser.

6. What CostAssured stores

Exactly these fields, and nothing else:

• Organisation: name, slug, plan, and the time of the read.
• Project: name, ref, region, status, created date, compute size, disk size, the add-ons selected (including any log drain or custom domain), the seven-day API request total, and whether its branches could be read.
• Read replica: identifier, region and compute size.
• Branch: name, whether it is persistent or the production branch, git branch name, pull request number, parent project, last-updated date and scheduled-deletion date.
• Estimate: the list-price lines built from the above.

No database content and nothing your users store.

7. How the figures are worked out

Supabase reports no spend through its API. CostAssured estimates each line from Supabase's public prices, which it checks and dates, and the setup it read: for example, a project on Large compute is priced for every hour of your billing period (720 hours in a 30-day period) at the published hourly rate. Tell us the day your bill renews in "Your data" and the estimate follows your invoice's period instead of the calendar month. Every figure in the report says it is an estimate at public list prices. Monthly active users, egress, file storage, Edge Function invocations and Realtime are not visible through the API, so they are not in the estimate.

8. Revoke access

Delete the token under Account > Access Tokens at any time. CostAssured stops reading at once; the next scan reports that the token was refused. You can also remove the connection in CostAssured, which deletes the stored token.