CostAssured for Supabase: see what is behind your bill, beyond the spend cap.

How we connect

A token you scope yourself

You create a scoped access token limited to one organisation, with every permission set to Read. Supabase does not let a token report its own permissions, so we cannot confirm a token is read-only for you. We call only the endpoints listed in our guide, and we refuse a full-access token before making a single call.

Supabase does not let a token report its own permissions, so CostAssured cannot prove that your token is read-only. We only ever read, and we call only the endpoints in our guide. Set every permission on the token to Read, name it so you will recognise it, and delete it the moment you stop using us.

What we will never do

• ×We will never: Change a setting or a resource in your account
• ×We will never: Read your app data, prompts or files
• ×We will never: Sit in your request path
• ×We will never: Keep your key after you disconnect
• ×We will never: Use your data to train AI models
• ×We will never: Take a percentage of your spend or savings

We store usage metadata and configuration inventory, never telemetry or application content.