Supabase MCP setup: keys, tokens, and safe AI access

Learn where to find your Supabase project URL, anon key, service key, and account access token for Best AI CEO MCP.

• Category: Website Integrations
• Tags: Supabase, MCP, Database, Auth, Storage
• Updated: Jun 8, 2026

Best AI CEO can connect a brand to Supabase so the AI tools can inspect project health, understand database tables, set up Auth and Storage, and, when you explicitly allow it, perform admin actions through MCP.

What to save in Best AI CEO

Open your brand, go to **Website → Integrations → Supabase MCP**, then save the fields that match how much access you want the connected AI client to have.

• **Project URL:** the Supabase project endpoint, usually `https://your-project-ref.supabase.co`.

• **Anon or publishable key:** safe for browser and mobile clients. It follows Row Level Security and is useful for read checks and client-style access.

• **Service role or secret key:** a backend-only admin key. It can bypass Row Level Security, so use it only when the AI should manage database rows, Storage, or Auth admin tasks.

• **Management API token:** an account-level Supabase token used for Management API work such as remote SQL migrations and project-level operations.

Where to find the project URL and API keys

• Sign in to the Supabase Dashboard.

• Open the project you want Best AI CEO to manage.

• Go to **Project Settings → API Keys**.

• Copy the **Project URL**.

• Copy the **anon/public** or **publishable** key for client-safe access.

• Copy the **service_role**, **secret**, or server-side key only if you want backend admin access.

Newer Supabase projects may use publishable and secret key names. Legacy projects often show anon and service_role under Legacy API Keys. In Best AI CEO, both naming styles are supported.

How to create a Supabase account access token

The Management API token is different from your project API keys. It belongs to your Supabase account and lets trusted automation access the Management API with your account permissions.

• Sign in to Supabase.

• Open supabase.com/dashboard/account/tokens, or use your account menu and open **Access Tokens**.

• Click the button to create or generate a new token.

• Name it clearly, for example **Best AI CEO MCP - Makild**.

• If Supabase asks for an expiry, choose the shortest period that still fits your workflow.

• Copy the token immediately. Supabase only shows it once.

• Paste it into **Management API Token** in Best AI CEO and save.

What each key is used for

| Credential

| Use

| Risk level

| Anon / public / publishable key

| Client-safe reads and requests that obey Row Level Security.

| Lower

| Service role / secret key

| Backend admin access for rows, Storage, and Auth admin actions.

| High

| Management API token

| Project-level management, remote SQL, and Supabase Management API operations.

| High

How to keep it safe

• Never place the service role key, secret key, or Management API token in frontend code.

• Only enable **Allow AI Supabase admin actions** when you want the AI to make real changes.

• Keep dry runs on while planning migrations or schema changes.

• Rotate keys if a token was pasted into the wrong place or shared with the wrong person.

• After updating MCP credentials, reconnect or restart the AI MCP client so it reloads the tool list.

With the correct keys saved, Best AI CEO MCP can help take a Supabase-backed project live: inspect schema, create tables, run SQL, configure Auth, prepare Storage buckets, and keep a record of admin actions through MCP audit history.