# Supabase CLI commands that don't work with SupaHost

> Which Supabase CLI commands work with SupaHost (local dev, migrations, db diff, gen types, db dump over the tunnel) and which fail because they need the Supabase Management API.

Source: https://supahost.app/kb/cli-forbidden-or-unsupported · Updated 2026-11-11

## What you see

A Supabase CLI command that talks to "the project" fails. Depending on the command and whether you're logged in, you get messages like:

```
Invalid project ref format. Must be like `abcdefghijklmnopqrst`.
```

```
Invalid access token format. Must be like `sbp_0102...1920`.
```

or a `403 Forbidden` / "Forbidden resource" error from `api.supabase.com`.

## Why it happens

Many CLI commands don't connect to your project directly. They call the Supabase Management API at `api.supabase.com`, using a Supabase Cloud project ref and a Supabase access token (`sbp_…`). SupaHost projects aren't on Supabase Cloud, and SupaHost doesn't implement the Management API. So there's nothing for those commands to reach, and SupaHost access tokens (`shp_…`) aren't accepted in place of a Supabase token.

Commands that only use your local stack, or talk plain Postgres through `--db-url`, are fine.

## What works and what doesn't

| Command | Works with SupaHost? | Use instead |
|---|---|---|
| `supabase init`, `start`, `stop`, `status` | Yes (local only) | |
| `supabase migration new <name>` | Yes | |
| `supabase db reset` (local) | Yes | |
| `supabase db diff --local` | Yes | |
| `supabase gen types typescript --local` | Yes | Or MCP `generate_typescript_types` |
| `supabase test db` (local) | Yes | |
| `supabase db dump --db-url <url>` | Yes, on Business/Enterprise over the SSH tunnel | Or **Create pg_dump** on the Backups tab |
| `supabase link --project-ref …` | No | Nothing to link; use the project URL and keys |
| `supabase db push` | No (needs `link`) | MCP `apply_migration`, or Studio's SQL editor |
| `supabase db pull` | No (needs `link`) | `db dump --db-url` on Business, or **Create pg_dump** |
| `supabase functions deploy` | No | **Functions** tab, or MCP `deploy_edge_function` |
| `supabase secrets set` / `list` | No | **Functions** tab → Secrets card |
| `supabase gen types --project-id …` | No | `--local`, or MCP `generate_typescript_types` |
| `supabase projects`, `orgs`, `branches`, `domains`, `sso`, `postgres-config` | No | The SupaHost dashboard |

Commands that accept `--db-url` connect straight to Postgres. On Business and Enterprise they can go through the SSH tunnel, as in the dump example below.

## A workflow that works

1. Develop locally with `supabase start`.
2. Write each change as a migration:

   ```bash
   supabase migration new add_bookings_status
   # edit supabase/migrations/<timestamp>_add_bookings_status.sql
   supabase db reset   # replays all migrations locally
   ```

3. Apply it to SupaHost. Ask your AI agent to apply the migration over MCP (`apply_migration`), or paste the file into Studio's SQL editor. MCP records it in `supabase_migrations.schema_migrations`, the same table the CLI uses.
4. Deploy functions from the **Functions** tab or over MCP.

To dump a SupaHost project with the CLI on Business:

```bash
ssh -N -L 5432:127.0.0.1:5432 supahost@acme.supahost.space
# in a second terminal:
supabase db dump --db-url "postgresql://postgres:<password>@127.0.0.1:5432/p_app_one" -f schema.sql
```

## On SupaHost

- Don't run `supabase login` with a SupaHost token. It expects a Supabase Cloud token.
- Migrations written for Supabase Cloud may include `create extension pg_cron`, which fails on SupaHost. See [ERROR: can only create extension in database postgres](/kb/create-extension-pg-cron).

## Related

- [Local development with the Supabase CLI](/docs/local-development/overview)
- [Migrations workflow: local to SupaHost](/docs/local-development/migrations-workflow)
- [supabase functions deploy doesn't work with SupaHost](/kb/cli-functions-deploy)
- [Deploying functions](/docs/functions/deploying)