Can an AI agent sign up for Supabase on its own?

No. Sign-up: needs a human. No documented headless sign-up. The web form shows a visible hCaptcha image puzzle on Sign up.

Supabasesupabase.com

Can an AI agent use Supabase?

Q: Can an AI agent pay for Supabase?

Payment not reached. No 402, no x402/MPP/UCP. Plans change on the dashboard billing page with a credit card (docs); from docs only, the checkout was not reached because sign-up is walled. Stripe Projects provisioning needs a Stripe account and a Supabase authorization screen.

As of 6 Oct 2026, an AI agent can't use Supabase on its own: hCaptcha puzzle on the sign-up form.

Level 1 · Needs a personAgents can't get in on their own.

Find: Docs for agents: llms.txt, an OpenAPI and an MCP server.
Access: Can't sign up.
Use: Work not reached.
Pay: Payment not reached.
Leave: Leaving not reached.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean

Visit Supabase Follow changes

Driven 6 Oct 2026Same level in 3 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

Agents on a serverStopped by a CAPTCHA on the sign-up form.
Signed agentsThe sign-up page opens. The CAPTCHA on the form stops them too.
Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Supabase.

On its own

Read all of the product's documentation and API reference automatically.
Register itself as an OAuth application for the product's AI-assistant connector.

What it can't, and why

Create an accountthe sign-up form shows an image puzzle (CAPTCHA) only a person can solve
Get a working login tokenlogging in and approving access both need a signed-in account
Create a database project or use any featureevery feature needs an account and a project first

Official server · no call worked

Does Supabase have an MCP server, and can an agent connect to it?

Yes. Supabase has an official MCP server. The server signs an agent in with OAuth.

A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at sign up (it needs a person). Through the MCP server, 0 of our agent's 1 attempt worked.

What the drive found

APIOpenAPIMCP · officialCLISDKllms.txtWebhooks–Sandbox

Payment not reached

Can an AI agent pay for Supabase?

Payment not reached.

Card checkout
Stripe Projects a third party's

It has a free plan.

What would let agents pay on their own

Accept x402 or MPP on your API. Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.Step-by-step guide

No 402, no x402/MPP/UCP. Plans change on the dashboard billing page with a credit card (docs); from docs only, the checkout was not reached because sign-up is walled. Stripe Projects provisioning needs a Stripe account and a Supabase authorization screen.

From the drive of 6 Oct 2026.

Not reached in this drive: the API key and deleting the account. Every checkpoint, in detail

For the team behind Supabase.

Where agents stop in Supabase today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

Let verified agents sign up headlessStep-by-step guide
Offer device flow for CLI and MCPStep-by-step guide
Advertise CIMD and drop PKCE plainStep-by-step guide

2 more fixes

Answer server/discover without a token
Add plan changes to the Management API Step-by-step guide

Claim it free and reply next to the result.
A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).

Get a Drive Claim it free

See the example report

Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

<a href="https://agentdrives.com/tools/supabase" rel="nofollow"><img src="https://agentdrives.com/badge/supabase.svg" alt="AgentDrives · Driven · L1 · Needs a person" height="24"></a>

Behind the level.

Our agent couldn't get into Supabase, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

llms.txt: found
OpenAPI: found
MCP server: found
CLI: found

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

1 Oct 20262 drivesL1Needs a person
6 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 25 attempts.

How an agent connects · 4 tips

/api/tools/supabase.json /tools/supabase.mdMCP get_tool {"slug":"supabase"}

Docs are agent-friendly: use https://supabase.com/llms.txt and append .md to any docs page.
Get a personal access token from a human (dashboard/account/tokens) and set SUPABASE_ACCESS_TOKEN; the CLI refuses interactive login without a TTY.
The MCP server needs OAuth; DCR at api.supabase.com/platform/oauth/apps/register works headless but consent needs a signed-in user.
Stripe Projects (stripe projects add supabase/project) is a documented alternative if a Stripe account exists; first use shows a Supabase authorization screen.

Every checkpoint, in detail · 9 checkpoints

DocsHeadlessllms.txt, llms-full.txt, .md pages and Accept: text/markdown, Management API OpenAPI 3.0.0 (115 paths), CLI reference: all fetched headless.
Sign upNeeds a humanNo documented headless sign-up. The web form shows a visible hCaptcha image puzzle on Sign up.
VerifyNot reachedNo sign-up, so no verification mail (none arrived).
KeyNot reachedOAuth client registration by DCR works headless (201), but authorize redirects to dashboard sign-in; CLI needs a token from the dashboard; no device flow.
First callNot reachedManagement API and MCP answer 401 without a token; no account to get one.
First actionNot reachedNo account, so no project was created.
PayNot reachedNo 402, no x402/MPP/UCP. Plans change on the dashboard billing page with a credit card (docs); from docs only, the checkout was not reached because sign-up is walled. Stripe Projects provisioning needs a Stripe account and a Supabase authorization screen.
CancelNot reachedNothing was started. Docs: plan changes and downgrades are made on the dashboard org billing page; no plan endpoint in the Management API.
DeleteNot reachedNo account or project was created. DELETE /v1/projects/{ref} is documented; an account-delete route was not found in the docs.

The attempt log · 25 attempts

Attempt log
Capability	Route	Result	Evidence
Agent discovery: Find llms.txt and docs index	api	done ✓	GET https://supabase.com/llms.txt 200 text/plain; links .md docs and llms-full.txt (7.2 MB)
Agent discovery: Markdown docs via Accept and .md URL	api	done ✓	GET /docs/guides/database/overview with Accept: text/markdown -> 200 content-type text/markdown, Vary: Accept; overview.md -> 200 text/markdown
Agent discovery: MCP server/discover at https://mcp.supabase.com/mcp	mcp	failed ✓	POST server/discover (MCP-Protocol-Version 2026-07-28) -> 401 {"message":"Unauthorized"}, WWW-Authenticate: Bearer resource_metadata="https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp"
Agent discovery: PRM and AS metadata	api	done ✓	PRM /.well-known/oauth-protected-resource/mcp 200 JSON (authorization_servers https://api.supabase.com, 13 scopes); root variant 404. AS metadata: registration_endpoint (DCR), grant types authorization_code, refresh_token, jwt-bearer; authorization_grant_profiles_supported id-jag; PKCE S256 and plain; no client_id_metadata_document_supported, no device_authorization_endpoint, no agent_auth block
Agent discovery: Cards: MCP server card, AI catalog, A2A	api	done ✓	https://mcp.supabase.com/mcp/server-card 404; /.well-known/ai-catalog.json 200 application/json (specVersion 1.0, entries incl. Supabase MCP server); /.well-known/mcp/server-card.json 404; /.well-known/agent-card.json 404 html; /.well-known/agent.json 404
Agent discovery: robots.txt and AI preferences	api	done ✓	robots.txt: User-agent * Allow /; 'Content-Signal: ai-train=yes, search=yes, ai-input=yes' (Cloudflare Content Signals syntax, parses); no aipref Content-Usage line or header
Agent discovery: OpenAPI for Management API	api	done ✓	GET https://api.supabase.com/api/v1-json 200 application/json, openapi 3.0.0, 115 paths, no x-payment-info
Agent discovery: /auth.md, /SKILL.md, /.well-known/ucp	api	done ✓	/auth.md 200 text/markdown but it is a product page about Supabase Auth, not a WorkOS agent-auth skill; /SKILL.md 404; /.well-known/ucp 404
Find docs: Read docs, API reference, CLI reference	api	done ✓	llms.txt, llms-full.txt, Management API OpenAPI, CLI reference all fetched headless
Sign up: Look for a documented headless sign-up / agent registration	none	blocked ✓	No sign-up API in docs or OpenAPI; AS metadata has no agent_auth; /auth.md is product copy. Claim tokens (/v1/projects/{ref}/claim-token) need an existing org owner. Stripe Projects route needs a Stripe account plus a Supabase authorization screen (docs: integrations/stripe-projects)
Sign up: Sign up with email+password at supabase.com/dashboard/sign-up	browser	blocked ✓	Filled email and password, clicked Sign up -> visible hCaptcha image puzzle ('Click on objects that can scoop up the material'), screenshot browser/shots/002.png. No mail arrived in an inbox inbox.
Get credentials: Register an OAuth client by DCR for MCP	api	partial ✓	POST https://api.supabase.com/platform/oauth/apps/register -> 201 client_id+client_secret (headless). /v1/oauth/authorize?...&resource=https://mcp.supabase.com/mcp redirects to /dashboard/sign-in (needs an account)
Get credentials: CLI login	cli	blocked ✓	supabase 2.119.0 'login --no-browser' -> LoginMissingTokenError 'Cannot use automatic login flow inside non-TTY environments. Please provide --token flag or set SUPABASE_ACCESS_TOKEN'; 'projects list' -> AccessTokenRequiredError. A token comes from dashboard/account/tokens (account needed)
First call: Unauthenticated Management API call	api	blocked ✓	POST https://api.supabase.com/v1/projects -> 401 {"message":"Unauthorized"}; no 402
Pay: Probe agent payment rails	api	done ✓	No 402 on API; x402./mpp./agents.supabase.com do not resolve; no x-payment-info in OpenAPI; /.well-known/ucp 404; x402 Bazaar no supabase entry; mpp.dev hit is a third party hosted on supabase.co, not Supabase. projects.dev catalog lists supabase/project and Supabase docs document Stripe Projects (developer preview, authorization screen on first provision). Billing FAQ: plan change in dashboard org billing, credit card only; Management API has only project billing/addons, no plan endpoint
Create and run a Postgres project with tables: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Query/manage data via auto-generated REST API: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Query data via auto-generated GraphQL API: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Secure data with Row Level Security policies: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Sign up and sign in users: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Upload, store and serve files (buckets): Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Deploy and invoke server-side TypeScript functions: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Subscribe to live database changes: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Broadcast low-latency messages: Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys
Store and query vector embeddings (pgvector): Drive on a free project	none	blocked	No account: sign-up behind hCaptcha; every route (Management API, MCP, CLI, project REST/GraphQL/Auth/Storage/Realtime) needs a project and its keys

Also in Databases.

All of Databases, by level

AirtableL4Gets in on its ownSupabase vs Airtable
NocoDBL4Gets in on its ownSupabase vs NocoDB
ConvexL3Gets in on its ownSupabase vs Convex
NeonL2Gets in on its ownSupabase vs Neon