Supabase Provider

Use the Supabase provider when Supabase Auth is your OAuth authorization server. Supabase handles login, consent, Dynamic Client Registration, and token issuance. Your MCP server verifies Supabase tokens and can use the caller’s access token for Row Level Security. This guide covers the Supabase setup path. Use the auth providers API reference for exact oauthSupabaseProvider() options, defaults, and errors.

Configure Supabase

In the Supabase Dashboard:

Go to Authentication > Sign In / Providers > OAuth Server.
Enable the OAuth 2.1 server.
Enable Allow Dynamic OAuth Apps so MCP clients can register.
Set the consent screen URL to a route your app implements, such as http://localhost:3000/auth/consent.
Enable at least one sign-in method for users.
Copy the Project ID and publishable key.

Supabase redirects users to your consent screen with an authorization_id. Your app must implement that route. The consent route signs the user in, loads the authorization details, and submits approve or deny back to Supabase. Start from the mcp-oauth-supabase-template if you do not already have a consent UI. Do not deploy the MCP server without a working consent route.

Set environment variables

MCP_USE_OAUTH_SUPABASE_PROJECT_ID=your-project-id
MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...

The provider reads the project ID. Your consent UI and tools that call Supabase use the publishable key. For local or self-hosted Supabase, set the Supabase URL instead of the hosted project ID:

MCP_USE_OAUTH_SUPABASE_URL=http://localhost:54321

Configure the MCP server

import { MCPServer } from "mcp-use";
import { oauthSupabaseProvider } from "mcp-use/oauth/supabase";

const server = new MCPServer({
  name: "supabase-server",
  version: "1.0.0",
  oauth: oauthSupabaseProvider(),
});

await server.listen(3000);

For local or self-hosted Supabase, pass the URL directly when you prefer not to use environment variables:

oauth: oauthSupabaseProvider({
  supabaseUrl: "http://localhost:54321",
});

New Supabase projects use ES256 tokens and expose JWKS metadata. Legacy HS256 projects may need a JWT secret; use the API reference for that option.

Use Supabase RLS from tools

Create a Supabase client per request with the caller’s access token. This lets Row Level Security evaluate policies as the authenticated user. Install the Supabase client when your tools call Supabase:

npm install @supabase/supabase-js

import { createClient } from "@supabase/supabase-js";
import { error, object } from "mcp-use";

const supabaseUrl =
  process.env.MCP_USE_OAUTH_SUPABASE_URL ??
  `https://${process.env.MCP_USE_OAUTH_SUPABASE_PROJECT_ID}.supabase.co`;

server.tool(
  {
    name: "list_notes",
    description: "Fetch notes visible to the authenticated Supabase user.",
  },
  async (_args, ctx) => {
    if (!ctx.auth) {
      return error("Unauthorized");
    }

    const supabase = createClient(
      supabaseUrl,
      process.env.MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY!,
      {
        auth: {
          persistSession: false,
          autoRefreshToken: false,
          detectSessionInUrl: false,
        },
        global: {
          headers: { Authorization: `Bearer ${ctx.auth.accessToken}` },
        },
      },
    );

    const { data, error: queryError } = await supabase.from("notes").select();

    if (queryError) {
      return error(queryError.message);
    }

    return object({ notes: data });
  },
);

Use this pattern only when the tool needs to call Supabase as the user. For server-owned operations, use a separate server credential and enforce your own authorization checks.

Verify the setup

Run the server and connect with an OAuth-capable MCP client.

npm run dev

Confirm these cases:

The client discovers Supabase OAuth metadata.
The user can sign in and approve consent.
Authenticated tool calls include ctx.auth.user.userId.
RLS-backed tools only return rows visible to the caller.

Next steps

Supabase OAuth template

Start from a consent UI wired for mcp-use and Supabase.

Supabase MCP Authentication

Review Supabase’s MCP authentication guide.

User Context

Use Supabase user data inside tools.