Supabase CLI commands that don't work with SupaHost
Which Supabase CLI commands work with SupaHost (local dev, migrations, db diff, gen types, db dump over the tunnel) and which fail because they need the Supabase Management API.
What you see
A Supabase CLI command that talks to "the project" fails. Depending on the command and whether you're logged in, you get messages like:
Invalid project ref format. Must be like `abcdefghijklmnopqrst`.
Invalid access token format. Must be like `sbp_0102...1920`.
or a 403 Forbidden / "Forbidden resource" error from api.supabase.com.
Why it happens
Many CLI commands don't connect to your project directly. They call the Supabase Management API at api.supabase.com, using a Supabase Cloud project ref and a Supabase access token (sbp_…). SupaHost projects aren't on Supabase Cloud, and SupaHost doesn't implement the Management API. So there's nothing for those commands to reach, and SupaHost access tokens (shp_…) aren't accepted in place of a Supabase token.
Commands that only use your local stack, or talk plain Postgres through --db-url, are fine.
What works and what doesn't
| Command | Works with SupaHost? | Use instead |
|---|---|---|
supabase init, start, stop, status |
Yes (local only) | |
supabase migration new <name> |
Yes | |
supabase db reset (local) |
Yes | |
supabase db diff --local |
Yes | |
supabase gen types typescript --local |
Yes | Or MCP generate_typescript_types |
supabase test db (local) |
Yes | |
supabase db dump --db-url <url> |
Yes, on Business/Enterprise over the SSH tunnel | Or Create pg_dump on the Backups tab |
supabase link --project-ref … |
No | Nothing to link; use the project URL and keys |
supabase db push |
No (needs link) |
MCP apply_migration, or Studio's SQL editor |
supabase db pull |
No (needs link) |
db dump --db-url on Business, or Create pg_dump |
supabase functions deploy |
No | Functions tab, or MCP deploy_edge_function |
supabase secrets set / list |
No | Functions tab → Secrets card |
supabase gen types --project-id … |
No | --local, or MCP generate_typescript_types |
supabase projects, orgs, branches, domains, sso, postgres-config |
No | The SupaHost dashboard |
Commands that accept --db-url connect straight to Postgres. On Business and Enterprise they can go through the SSH tunnel, as in the dump example below.
A workflow that works
Develop locally with
supabase start.Write each change as a migration:
supabase migration new add_bookings_status # edit supabase/migrations/<timestamp>_add_bookings_status.sql supabase db reset # replays all migrations locallyApply it to SupaHost. Ask your AI agent to apply the migration over MCP (
apply_migration), or paste the file into Studio's SQL editor. MCP records it insupabase_migrations.schema_migrations, the same table the CLI uses.Deploy functions from the Functions tab or over MCP.
To dump a SupaHost project with the CLI on Business:
ssh -N -L 5432:127.0.0.1:5432 [email protected]
# in a second terminal:
supabase db dump --db-url "postgresql://postgres:<password>@127.0.0.1:5432/p_app_one" -f schema.sql
On SupaHost
- Don't run
supabase loginwith a SupaHost token. It expects a Supabase Cloud token. - Migrations written for Supabase Cloud may include
create extension pg_cron, which fails on SupaHost. See ERROR: can only create extension in database postgres.