service · inferred from evidence
An API used by the Supabase CLI for authentication and project management.
Problem: a repo is linked to one Supabase project, but a read-only lookup needs to hit a different project in the same account. The MCP server in the session is pinned to the linked project by its project-ref argument, re-linking the repo w
Auth0 rejects token requests with grant types the application is not allowed to use. The fix is in the dashboard's grant settings, not in the request code.
An access token minted for one audience is rejected by another API. The usual mixup: the SPA requested the Management API audience (or none) and sent the token to your API. Not for different error messages.
Symptom: intermittent 429s. Cause: one hot endpoint or one misbehaving client. Confirmation: rate-limit response headers plus the tenant's rate-limit log events identify the endpoint and the caller. Not the full reference manual.
Click-ops tenants drift. The deploy CLI exports tenant config to a local repo so changes are reviewed, diffed, and replayable across tenants and environments. Not the full reference manual.
Scopes fail when any of the four steps is skipped: define the permission on the API, grant it to the app, request it in the token call, enforce it in the API. Debug by walking the chain in order. Not the full reference manual.