> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcp-use.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Supabase Provider

> Configure Supabase OAuth 2.1 server authentication for a TypeScript MCP server.

Use the Supabase provider when Supabase Auth is your OAuth authorization server. Supabase handles login, consent, Dynamic Client Registration, and token issuance. Your MCP server verifies Supabase tokens and can use the caller's access token for Row Level Security.

This guide covers the Supabase setup path. Use the [auth providers API reference](/typescript/api-reference/server/auth-providers#oauthsupabaseprovider) for exact `oauthSupabaseProvider()` options, defaults, and errors.

## Configure Supabase

In the [Supabase Dashboard](https://app.supabase.com/):

1. Go to **Authentication > Sign In / Providers > OAuth Server**.
2. Enable the OAuth 2.1 server.
3. Enable **Allow Dynamic OAuth Apps** so MCP clients can register.
4. Set the consent screen URL to a route your app implements, such as `http://localhost:3000/auth/consent`.
5. Enable at least one sign-in method for users.
6. Copy the Project ID and publishable key.

Supabase redirects users to your consent screen with an `authorization_id`. Your app must implement that route. The consent route signs the user in, loads the authorization details, and submits approve or deny back to Supabase.

Start from the [mcp-oauth-supabase-template](https://github.com/mcp-use/mcp-oauth-supabase-template) if you do not already have a consent UI. Do not deploy the MCP server without a working consent route.

## Set environment variables

```bash theme={null}
MCP_USE_OAUTH_SUPABASE_PROJECT_ID=your-project-id
MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...
```

The provider reads the project ID. Your consent UI and tools that call Supabase use the publishable key.

For local or self-hosted Supabase, set the Supabase URL instead of the hosted project ID:

```bash theme={null}
MCP_USE_OAUTH_SUPABASE_URL=http://localhost:54321
```

## Configure the MCP server

```typescript theme={null}
import { MCPServer } from "mcp-use";
import { oauthSupabaseProvider } from "mcp-use/oauth/supabase";

const server = new MCPServer({
  name: "supabase-server",
  version: "1.0.0",
  oauth: oauthSupabaseProvider(),
});

await server.listen(3000);
```

For local or self-hosted Supabase, pass the URL directly when you prefer not to use environment variables:

```typescript theme={null}
oauth: oauthSupabaseProvider({
  supabaseUrl: "http://localhost:54321",
});
```

New Supabase projects use ES256 tokens and expose JWKS metadata. Legacy HS256 projects may need a JWT secret; use the API reference for that option.

## Use Supabase RLS from tools

Create a Supabase client per request with the caller's access token. This lets Row Level Security evaluate policies as the authenticated user.

Install the Supabase client when your tools call Supabase:

```bash theme={null}
npm install @supabase/supabase-js
```

```typescript theme={null}
import { createClient } from "@supabase/supabase-js";
import { error, object } from "mcp-use";

const supabaseUrl =
  process.env.MCP_USE_OAUTH_SUPABASE_URL ??
  `https://${process.env.MCP_USE_OAUTH_SUPABASE_PROJECT_ID}.supabase.co`;

server.tool(
  {
    name: "list_notes",
    description: "Fetch notes visible to the authenticated Supabase user.",
  },
  async (_args, ctx) => {
    if (!ctx.auth) {
      return error("Unauthorized");
    }

    const supabase = createClient(
      supabaseUrl,
      process.env.MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY!,
      {
        auth: {
          persistSession: false,
          autoRefreshToken: false,
          detectSessionInUrl: false,
        },
        global: {
          headers: { Authorization: `Bearer ${ctx.auth.accessToken}` },
        },
      },
    );

    const { data, error: queryError } = await supabase.from("notes").select();

    if (queryError) {
      return error(queryError.message);
    }

    return object({ notes: data });
  },
);
```

Use this pattern only when the tool needs to call Supabase as the user. For server-owned operations, use a separate server credential and enforce your own authorization checks.

## Verify the setup

Run the server and connect with an OAuth-capable MCP client.

```bash theme={null}
npm run dev
```

Confirm these cases:

* The client discovers Supabase OAuth metadata.
* The user can sign in and approve consent.
* Authenticated tool calls include `ctx.auth.user.userId`.
* RLS-backed tools only return rows visible to the caller.

## Next steps

<CardGroup cols={2}>
  <Card title="Supabase OAuth template" icon="github" href="https://github.com/mcp-use/mcp-oauth-supabase-template">
    Start from a consent UI wired for mcp-use and Supabase.
  </Card>

  <Card title="Supabase MCP Authentication" icon="book-open" href="https://supabase.com/docs/guides/auth/oauth-server/mcp-authentication">
    Review Supabase's MCP authentication guide.
  </Card>

  <Card title="User Context" icon="user" href="/typescript/server/authentication/user-context">
    Use Supabase user data inside tools.
  </Card>

  <Card title="Supabase provider API reference" icon="terminal" href="/typescript/api-reference/server/auth-providers#oauthsupabaseprovider">
    Look up exact provider options and defaults.
  </Card>
</CardGroup>