2249 Commits

Include renames

Author	SHA1	Message	Date
Miranda Limonczenko	4d57edd622	docs(database): add data type guidance to the tables guide (#50025) ... Refs FDBKIN-4668 Part 5 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50024. ## Problem Reader feedback in FDBKIN-4668 reports developers mixing `timestamptz` and `timestamp` across production schemas for lack of guidance. This PR adds the guidance half of that ask. The issue also asks for linting in the schema designer, which is a Frontend change and stays open. The page listed 44 data types and recommended neither side of any pair a reader actually has to choose between: `timestamp` or `timestamptz`, `varchar` or `text`, `numeric` or `float`, `integer` or `bigint`. No example on the page had a timestamp column at all, and `timestamptz` appeared only inside the reference table. ## Solution Adds a short "Choosing a type" section to the Reference group, stating a safe default for each pair and why. Also changes `salary bigint` to `salary numeric` in the private schema example. That line was checked against the wrong-outcome test in #50023 and deliberately left there, because a reader storing cents in a `bigint` gets a working table. It changes here because **this branch is what makes it wrong**: once the page recommends `numeric` for money, an example doing the opposite two screens away teaches the reader the opposite of what the page just said. ## Manual testing Preview: https://docs-git-docs-tables-datatypes-supabase.vercel.app/docs/guides/database/tables#choosing-a-type 1. Open the preview at that anchor. "Choosing a type" renders above the data type table. 2. Open `#data-types` on the same preview. It still lands on the reference table, which Studio deep-links to from three components. 3. In a local database, insert `1234.56` into `private.salaries.salary` and select `salary * 3`. Returns `3703.68` exactly. ## Verification (`test-the-docs`) Run in the Compose sandbox against a local stack. | Check | Result | | --- | --- | | `create table private.salaries` with `salary numeric` | pass | | `insert ... values (1234.56, ...)` then `select salary, salary * 3` | pass — returns `1234.56` and `3703.68`, exact | The same example failed to run at all before this stack, because `public.actors` didn't exist on the page's path. #50023 fixes that. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the Postgres tables guide with practical guidance for choosing column types. - Added recommendations for timestamps, text, monetary and decimal values, and identifiers. - Updated the example salary column to use the `numeric` type instead of `bigint`. - Expanded the column type reference section to help readers select appropriate types for common data. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-14 19:50:23 -07:00
Miranda Limonczenko	ef3cfad9ed	docs(database): add access control to the tables guide (#50024) ... Closes DOCS-1314 Brings the Eval to green. Part 4 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50023. ## Problem The page taught table creation and never said to protect a table. Across the original 573 lines, "row level security" appeared once, and that mention was about `security_invoker` on views. There was no `enable row level security`, no policy, and no `auth.uid()` anywhere. The gap was uneven between the two paths the page offers. The Table Editor enables row level security by default and warns that a table without it is publicly writable and readable. The SQL path on the same page produced an unprotected table and said nothing about it. Two further gaps followed from that one: - **Every example was a single access class.** `movies`, `categories`, `actors`, `performances`, and `private.salaries` are all the same shape. The page had no pattern for what most applications actually look like: a shared table everyone reads sitting beside a per-person table only its owner reads. The shared one is the one that gets skipped. - **Nothing told the reader to check the result.** No verify, no confirm, and no expected output anywhere on the page. ## Solution Adds a "Securing your tables" section between creating a table and loading data: - Enabling row level security and writing a first policy, with the consequence stated: a table with row level security and no policy returns no rows to anyone. - A worked example with two access classes, `movies` and `watchlists`. - A verification step. Two queries against `pg_tables` and `pg_policies` confirm that every table exists, has row level security enabled, and has at least one policy. Policy examples follow the idioms in the Row Level Security guide, including the wrapped `(select auth.uid())` form. The guide is cross-referenced rather than restated. ## Verification (`test-the-docs`) All 22 SQL fences on the page were run in document order against a local stack, the way a reader pasting top to bottom would. | Snippet / step | Class | Result | Notes | | --- | --- | --- | --- | | `create table movies` (Creating tables) | runnable-local | pass | | | `create table movies` ×2 (Primary keys) | illustrative-only | skipped | Re-shows the same table to explain `identity`; not a continuation | | `alter table movies enable row level security` | runnable-local | pass | | | `create policy "Anyone can read movies"` | runnable-local | pass | | | `create table watchlists` + 2 policies | runnable-local | pass | | | Verification query, `pg_tables` | runnable-local | pass | Lists both tables with `rowsecurity` true | | Verification query, `pg_policies` | runnable-local | pass | Lists all three policies | | `insert into movies` (Basic data loading) | runnable-local | pass | | | `create table categories` + foreign key | runnable-local | pass | | | `create table actors` / `performances` | runnable-local | pass | Failed before this stack; see below | | `create schema private` | runnable-local | pass | | | `create table private.salaries` | runnable-local | pass | Failed before this stack; see below | | Views section, 9 fences | illustrative-only | skipped | Depend on `students`, `courses`, and `grades`, which the page shows as rendered tables and never creates | **Tier A path:** `movies` → enable RLS → policy → `watchlists` + policies → both verification queries → `insert into movies` → `categories` + FK → `actors`/`performances` → `private` schema → `private.salaries`. Runs clean end to end. **Tier B, RLS behavior.** Every access claim in "Securing your tables" was exercised with two real users: | Check | Expected | Observed | | --- | --- | --- | | User A inserts into their own watchlist | succeeds | succeeds, A sees 1 row | | User B reads A's rows | 0 rows | 0 rows | | `anon` reads `movies` | rows returned | 2 rows | | `anon` reads `watchlists` | 0 rows | 0 rows | | User B inserts a row owned by A | rejected | `new row violates row-level security policy for table "watchlists"` | **Environment:** Compose sandbox (`sandbox/run.sh up-stack`), DinD + `supabase start`, Postgres 17. Fences ran in-container only, never on the host. **Note on the sandbox.** `supabase start` inside the nested daemon hit repeated `toomanyrequests: Rate exceeded` from ECR Public. The CLI retries and the stack does come up, but expect a slow first run. ## What this PR leaves to the one above it Data type guidance is #50025. ## Manual testing Preview: https://docs-git-docs-tables-rls-supabase.vercel.app/docs/guides/database/tables#securing-your-tables 1. Open the preview at that anchor. The three subsections render, and the numbered steps show their embedded SQL blocks. 2. In a local project, run the `movies` and `watchlists` snippets, then the two verification queries. Both tables appear with `rowsecurity` true and at least one policy each. 3. As a signed-out client, select from `movies` and from `watchlists`. `movies` returns rows; `watchlists` returns none. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Expanded the database tables guide with instructions to secure tables before adding rows. - Added guidance on enabling row-level security and creating policies for shared and per-person tables. - Clarified that policies control row access, while revoked table grants can cause permission errors. - Documented owner-scoped access using authenticated user IDs and ways to verify table protection. - Explained that read-only policies reject inserts through the Data API and provided alternatives. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-14 18:49:11 -07:00
Miranda Limonczenko	31a0f450cf	docs(database): correct the Dashboard table creation steps (#50023) ... Part 3 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50022. ## Problem Three claims fail the test that a reader following the page would hit a wrong outcome. **The Dashboard steps don't match the product.** They said to click **New Table**, save, then click **New Column**. Columns are defined inside the table creation panel, so a reader who follows the steps saves a table with no columns and then hunts for a button that isn't part of that flow. The labels are also sentence case in the product: **New table** and **New column**. **The Dashboard example diverges from the rest of the page.** The steps created a table named `todos` with a `task` column, while the SQL tab beside them and every later example use `movies`. A reader who took the Dashboard path and then ran the first Loading data snippet got `relation "movies" does not exist`. **The page's SQL doesn't compose.** Running every fence in document order showed that the many-to-many example under "Joining tables with foreign keys" opened by creating `movies` again. A reader who already created it got `relation "movies" already exists`, the block stopped, so `actors` was never created, and the `private.salaries` example two sections later then failed with `relation "public.actors" does not exist`. **One redundant statement broke two sections.** **The bulk loading example couldn't work.** `COPY` accepts text, CSV, and binary input, and the page listed JSON. `\COPY movies FROM './movies.csv'` expects a value for every column, and `movies` has three while the sample file has two. The options example passed `CSV HEADER` against a file with no header row, which silently dropped the first record. Found by CodeRabbit. ## Solution Rewrites the five Dashboard steps to match the panel and to produce `movies`, so both tabs leave the reader in the same place. Drops the redundant `create table movies` from the many-to-many block; the prose above it already says "You have a list of `movies`". Names the columns in both `COPY` commands, corrects the format list, points the `HEADER` example at a file that has one, and removes the space before each quoted CSV field. Dashboard changes verified against `TableEditor.tsx`, which renders `ColumnManagement` inside the creation panel; `TableEditorMenu.tsx` and `ColumnList.tsx` for the labels; and `DEFAULT_COLUMNS` in `TableEditor.constants.ts` for the `id` and `created_at` columns the editor adds. ## Checked and deliberately left - `grant all on table transcripts to authenticated`. Broader than the example needs, but a reader gets the working result the page promises, so it doesn't meet the bar for this branch. - "By default, views are accessed with their creator's permission." Accurate. `security_invoker` is opt-in. - `salary bigint` in the private schema example. Left here; it changes in #50025, where the page starts recommending `numeric` for money and the example becomes inconsistent with it. ## Flagged, not changed - The `api-create-table-sm.mp4` video in the Dashboard tab may show the older flow. Its contents weren't verified. - **Nothing in the Views section is runnable.** All nine of its fences depend on `students`, `courses`, and `grades`, which the page shows as rendered tables and never creates. Supplying that DDL is new content, so it isn't this branch's job, but it's worth a ticket. ## Manual testing Preview: https://docs-git-docs-tables-technical-supabase.vercel.app/docs/guides/database/tables 1. Open the preview and read the Dashboard tab under "Creating tables". It says **New table**, creates `movies`, and defines both columns in the same panel. 2. Open the Table Editor in a project and click **New table**. The panel has a **Name** field and a **Columns** section, and there is no separate **New Column** step. 3. In a fresh local database, run the SQL fences from "Creating tables" through `private.salaries` in page order. Each one succeeds. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the “Creating tables” guide to use a `movies` table with `name` and `description` columns. - Reworded and consolidated the table-creation steps, including the `created_at` column in the SQL example. - Updated bulk data loading instructions for CSV imports, connection setup, named columns, and header-delimited files; removed JSON from the listed formats. - Simplified the many-to-many example by removing the redundant `movies` table definition. - Clarified schema selection based on the current `search_path`. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-14 17:32:36 -07:00
3 people	74c116de74	docs: add Multigres Public Alpha documentation — MERGE ON SEP 14, 2026 (#49020) ... ## I have read the CONTRIBUTING.md file. YES ## What kind of change does this PR introduce? This PR adds Public Alpha documentation for Multigres, Supabase's multi-node Postgres high-availability integration. It introduces an overview guide, a compatibility stub, Database sidebar navigation, a Features table row, and a "What you get" card grid. ContentListings items can now omit `href` so those cards are not forced to be links. Linear: MUL-452. ~~🚨 **DO NOT MERGE UNTIL THE PUBLIC ALPHA GOES LIVE** 🚨~~ [@jhydra12 OK'ed merging, FYI] ## What is the current behavior? - Linear item: Documentation for Multigres - Production has no Multigres guides. `https://supabase.com/docs/guides/database/multigres` and `https://supabase.com/docs/guides/database/multigres/compatibility` return 404 - The Database sidebar has no Multigres section - The Features status table does not list Multigres - ContentListings items required a link (`href` was mandatory) ## What is the new behavior? - Overview guide at `/docs/guides/database/multigres` covering alpha status, eligibility, enablement, and what is not included - Compatibility stub at `/docs/guides/database/multigres/compatibility` - Database sidebar: Multigres → Overview, Compatibility (after OrioleDB) - Features table: Database / Multigres / `public alpha` - "What you get" renders as three non-link ContentListings cards - `href` is optional on ContentListings items; markdown export renders unlinked entries when it is omitted ## Additional context - Worktree: ~/GitHub/supabase/supabase-worktrees/nikrichers/mul-452-documentation-for-multigres-ready - Branch commits: Initial Multigres docs draft; Edits (cards, copy, MDX comments); merge master; spelling allow-list for Multigres, Vitess, and sharding - Verification: | Check | Result | | --------------------------------------- | --------------- | | Preview overview | 200 | | Preview compatibility | 200 | | Production overview | 404 (expected) | | Production compatibility | 404 (expected) | | `supa-mdx-lint` on changed MDX | pass | | `vitest` `lib/content-listings.test.ts` | pass (21 tests) | ### Proof: Multigres docs pages render, including non-link What you get cards **Verified:** production 404 · Vercel docs preview 200 #### Overview [(PR preview)](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres) <img width="1388" height="2272" alt="image" src="https://github.com/user-attachments/assets/2780f728-07c0-4320-9826-8f6e68df21e6" /> #### Compatibility [(PR preview)](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres/compatibility) <img width="1388" height="852" alt="image" src="https://github.com/user-attachments/assets/1f8f7181-5b7d-4d01-b376-a2eac923626b" /> ### Test plan - [ ] [Production overview](https://supabase.com/docs/guides/database/multigres) (404) vs [preview overview](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres) - [ ] [Production compatibility](https://supabase.com/docs/guides/database/multigres/compatibility) (404) vs [preview compatibility](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres/compatibility) - [ ] Database sidebar shows Multigres → Overview and Compatibility after OrioleDB - [ ] Overview shows Public Alpha caution, three What you get cards (not links), eligibility, and one-way-migration caution - [ ] Compatibility page is a placeholder that links back to the overview - [ ] Features table lists Database / Multigres / `public alpha` - [ ] `supa-mdx-lint` on `apps/docs/content/guides/database/multigres.mdx`, `apps/docs/content/guides/database/multigres/compatibility.mdx`, and `apps/docs/content/guides/getting-started/features.mdx` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Multigres documentation covering availability, setup, compatibility, limitations, migration behavior, and external resources. * Added Multigres to database navigation and feature-status listings. * Added an overview of Multigres benefits, including automatic failover, unchanged connection strings, and consensus-backed write durability. * **Improvements** * Content listings now support informational items without links across layouts. * Improved listing rendering and click tracking for linked and non-linked items. * **Documentation** * Added spelling support for Multigres, Vitess, and sharding terminology. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Nik Richers <nik@validmind.ai> Co-authored-by: Cursor Agent <cursoragent@cursor.com>	2026-09-15 09:48:39 +10:00
Miranda Limonczenko	5979218c97	docs(database): split out views and group the tables guide by information type (#50022) ... Part 2 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50021. ## Problem Four structural problems, all covered by the Guides section of CONTRIBUTING. **Views was a second topic living inside a guide about tables.** Roughly 180 lines, its own subsections four levels deep, sharing nothing with the tables above it beyond the word "table". **The page didn't say what it was for.** It opened with three paragraphs and a sample table before a reader could tell whether the page matched their goal. CONTRIBUTING asks a guide to begin with a sentence declaring its intent. **The top level mixed information types.** It was a flat list of every task, so "Schemas" and "Primary keys" sat beside "Creating tables" and background interrupted the action path. **Reference material interrupted the procedure.** A 44-row data type table sat between "Creating tables" and "Loading data", so a reader following the action path walked through it. Plus a duplicate video: the Dashboard tab under "Joining tables with foreign keys" embedded the same YouTube ID that frontmatter already serves as the table of contents video. ## Solution Moves and regrouping. - **Views moves to its own page**, `guides/database/views`, with its headings promoted one level and the two view-related links from Resources moved with it. - The page opens with an intent sentence, then a section outline, then a "What is a table?" section holding the definition and the spreadsheet comparison. - The remaining sections split into three groups by information type, ordered procedures, context, reference: **Creating and managing tables** holds creating, loading, and joining; **How tables are organized** holds primary keys, relationships, and schemas; **Reference** holds the data type table. - "Joining tables with foreign keys" held both classes, so it splits. The steps keep the heading and stay in the procedures group. The concept, what relational means and the diagram showing it, becomes **Relationships between tables** in the context group. The two cross-reference each other. - The duplicate video goes, and with the Dashboard tab empty the surrounding `Tabs` wrapper goes too. ## Anchors **Every heading keeps its text, so every anchor keeps its slug.** Demoting a heading changes its level, not its anchor. That matters because the inbound links are mostly outside `apps/docs`: Studio deep-links to `#data-types` from three components and `#primary-keys` from two, and `apps/www` links to `#creating-tables` and `#joining-tables-with-foreign-keys`. `#views` is the one exception, since that content left the page. Its single inbound link, in `guides/ai/engineering-for-scale.mdx`, now points at the new page, and both `NavigationMenu.constants.ts` entries are updated: the existing item becomes "Managing tables and data" and a "Views" item sits beside it. ## One deletion that isn't a move The "Columns" heading and its one sentence, "You must define the data type when you create a column." The heading held only the two subsections that moved out, and the sentence repeats a line 50 lines above it. ## Deferred Reordering "View security" behind an access-control foundation. That move only reads correctly once the foundation exists, so it travels with that content in #50024. ## Manual testing Preview: https://docs-git-docs-tables-structure-supabase.vercel.app/docs/guides/database/tables 1. Open the preview. The page opens with its intent, then a four-entry outline, then "What is a table?". Each outline link resolves, and the three groups below read as procedures, then context, then reference. 2. Open `#data-types`, `#primary-keys`, `#creating-tables`, and `#joining-tables-with-foreign-keys` on the preview. All four still land on their sections. 3. Open https://docs-git-docs-tables-structure-supabase.vercel.app/docs/guides/database/views. The new page renders, and "Views" appears in the sidebar beside "Managing tables and data". 4. Run `pnpm build:guides-markdown` from `apps/docs`. It generates 782 files, one more than before. Discard the change to `public/markdown/manifest.json`, which the repo commits as `[]`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added a dedicated guide covering Postgres views, including creation, querying, security options, and materialized views. - Reorganized the Tables and data guide with clearer sections, navigation links, table organization details, and reference information. - Updated the many-to-many example to display SQL directly. - Split database navigation into separate “Managing tables and data” and “Views” entries. - Added a PostgreSQL log configuration entry and a C# client reference link. - Updated documentation links to point to the new Views guide. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-14 16:43:05 -07:00
Miranda Limonczenko	e022145be9	docs(database): apply house style to the tables guide (#50021) ... Part 1 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`, one change type per PR. ## Problem The page addressed the reader as "we" in about 18 places. CONTRIBUTING reserves `we` for the Supabase team and asks that the reader be `you`. None of it was caught by the linter, because `Rule004ExcludeWords/first_person` only bans singular first person. Alongside that: scare quotes on established terms, parenthetical asides that CONTRIBUTING disallows, future tense where present tense reads better, an ordered list that repeated `1.` four times, and three relative links where `/docs/...` paths belong. **The three diagrams had alt text that named a topic instead of describing the picture.** "Schemas and tables" tells a screen reader nothing about a diagram showing two schema boxes, one labeled `public` holding six tables and one labeled `api` holding three. ## Solution Inline rewrites and cuts. **Nothing in this PR moves a line from one place to another.** Each alt now describes its diagram: the column types in the table diagram, the arrow between matching columns in the foreign key diagram, and the two labeled schemas with their table counts. Two deletions worth calling out: - The `<br />` spacer after the data type table. - The four-item benefits list under "When to use views". The four headings immediately below restate it verbatim. Also fixes "Every column is a predefined type", which states the relationship backwards. A column has a type; it isn't one. ## One dead link, surfaced by the conversion The Loading data intro pointed at `guides/database/api`, which isn't a page. It exists only as a redirect in `apps/www/lib/redirects.js`, and that redirect doesn't serve the docs deployment, so the link 404s there. As a relative link it was invisible to the link checker; converting it to a `/docs/...` path is what made the Docs E2E suite catch it. It now points at `/docs/guides/api`, the live page that 13 other guides already link to. ## What this PR leaves to the ones above it Section moves and the Views page split are #50022. Corrections to claims are #50023. New content is #50024 and #50025. ## Manual testing Preview: https://docs-git-docs-tables-style-supabase.vercel.app/docs/guides/database/tables 1. Open the preview. The intro reads "Excel spreadsheets" and "relational databases", and the only remaining "we" is "We provide a SQL editor within the Dashboard", which refers to Supabase rather than the reader. 2. Inspect the three images on the preview. Each `alt` describes the diagram rather than naming its topic. 3. Follow the **Data API** link under "Loading data". It resolves instead of returning 404. 4. Run `npx prettier --check apps/docs/content/guides/database/tables.mdx` and `pnpm lint:mdx` from `apps/docs`. Both pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified guidance on table creation, data types, primary keys, bulk loading, relationships, schemas, views, and materialized views. - Improved wording, capitalization, terminology, and internal navigation throughout the tables guide. - Updated diagram alt text with more descriptive captions. - Updated the loading data section to link to the Data API guide. - Revised the bulk-loading example with an explicit column list, CSV options, and a simplified database connection command. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-14 16:31:11 -07:00
5 people	b0de9dd7a6	Create log docs (#47047) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? No docs on how to interpret and configure PG logs ## What is the new behavior? Adds docs on how to interpret and manage PG logs ## Additional context Related Linear issue: - https://linear.app/supabase/issue/DEBUG-131/create-docs-outlining-all-log-settings <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new guide for customizing Supabase-hosted Postgres logging. * Documented available log settings with default values, plus SQL examples to inspect effective settings and role-specific overrides. * Covered configuration options (CLI, Management API, SQL), including precedence rules, role-level override/reset examples, and restart guidance for scheduled logging. * Updated the docs navigation with a new “Postgres log configuration” entry. * **Chores** * Updated the MDX spelling allow list to include “subfield”. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Ali Waseem <waseema393@gmail.com>	2026-09-14 12:15:15 -04:00
Guillaume Faas	1531eb427d	docs(csharp): add new C# Reference for v8.0.0 (#50116) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Documentation update: add a new page for the C# SDK reference v8.0.0 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added C# client reference documentation for version 8.1.0. * Added navigation for the C# Reference v8 documentation. * Documented authentication, database, Realtime, Storage, filtering, and query APIs with C# examples. * **Documentation** * Added C# SDK 8.0.0 and 8.1.0 release notes, including breaking changes, new capabilities, and bug fixes. * Updated documentation version listings and search coverage for C# v8. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-14 10:07:26 +02:00
4 people	26585dd4a4	[bot] Sync from supabase/troubleshooting (#50284) ... This PR syncs the latest troubleshooting guides from the supabase/troubleshooting repository. --------- Co-authored-by: github-docs-bot <github-docs-bot@supabase.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Miranda Limonczenko <czenko@users.noreply.github.com>	2026-09-11 15:24:43 -07:00
Anthony Lio	71d652483e	fix(docs): youtube iframe lack titles (#50225) ... ## What kind of change does this PR introduce? a11y bug fix on youtube embed ## What is the current behavior? YouTube iframes across guide pages have no `title` attribute, so screen readers announce them as an unnamed frame ## What is the new behavior? - extracts a `YouTube.tsx` ui component - adds `<YouTube id title />` + `title` as a required prop ## Test 1. visit `/docs/guides/ai/examples/openai` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Standardized embedded YouTube videos across guides with a consistent video player. - Added descriptive titles to improve accessibility and clarity. - Preserved existing video content and playback behavior. - Updated video embeds across AI, authentication, database, functions, realtime, self-hosting, storage, and migration documentation. - **New Features** - Added privacy-enhanced YouTube playback for embedded documentation videos. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-11 23:37:52 +03:00
Miranda Limonczenko	15a7b0ab18	docs(database): correct the dashboard_user and storage admin role descriptions (#50274) ... Closes DOCS-1387 ## Problem The Postgres roles guide describes `dashboard_user` as "For running commands via the Supabase UI." That was the original intent, not current behavior. Dashboard queries run as `postgres` and carry a `-- source: dashboard` comment, which the [Postgres logs troubleshooting guide](https://supabase.com/docs/guides/troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj) already documents. The two pages contradict each other. Two smaller problems in the same list: - `supabase_storage_admin` is described as an Auth middleware role, copied from the `supabase_auth_admin` entry above it. - Studio ships both stale strings in its own role tooltips. The docs list and `QUERY_PERFORMANCE_ROLE_DESCRIPTION` are near-verbatim copies of each other. ## Solution - Replace the `dashboard_user` description with what the Dashboard connects as instead, and point readers to the `-- source: dashboard` comment for finding Dashboard queries in the logs. - Attribute `supabase_storage_admin` to the Storage middleware. - Apply both corrections to the Query Performance and Query Insights role tooltips. ## Manual testing 1. Open the [roles guide on the deploy preview](https://docs-git-docs-dashboard-user-role-supabase.vercel.app/docs/guides/database/postgres/roles). 2. Scroll to `dashboard_user`. It states that the Dashboard doesn't connect as the role, and that Dashboard queries execute as `postgres` with a `-- source: dashboard` comment. 3. Select **find them in the Postgres logs**. The Postgres logs troubleshooting guide loads. 4. Scroll to `supabase_storage_admin`. It reads "Used by the Storage middleware," not "Auth middleware." 5. In Studio, open **Observability > Query Performance** and hover a `dashboard_user` or `supabase_storage_admin` value in the **Role** column. The tooltip shows the same two corrected descriptions. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Corrected the description of the `supabase_storage_admin` role to reference Storage middleware. - Clarified that the Dashboard does not connect using the `dashboard_user` role. - Documented that Dashboard queries run as `postgres` and can be identified in Postgres logs with a `source: dashboard` comment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-11 11:57:25 -07:00
Anthony Lio	3de0e3a614	fix(docs): a11y alt text on Colab badge (#50222) ... ## What kind of change does this PR introduce? a11y fix ## What is the current behavior? Colab badge image is missing alt attribute leaving both image and the link unnamed _ screen reader users have no way to tell what the link does ## What is the new behavior? - adds `alt="Open in Colab"`, matching the text rendered inside the SVG so voice control users can activate it by its visible label ## Test 1. visit [/docs/guides/ai/google-colab](https://supabase.com/docs/guides/ai/google-colab) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Improved accessibility across AI guides and quickstarts by adding descriptive alternative text to “Open in Colab” badge images. - Updated Google Colab, LlamaIndex, face similarity, hello world, and text deduplication documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-11 17:42:27 +03:00
Anthony Lio	2e861b5415	fix(docs): guides table overflow (#50221) ... ## What kind of change does this PR introduce? bug fix of table usage within guides ## What is the current behavior? table markup is used within the observability guide causing overflow of the content ## What is the new behavior? favors table component usage within mdx guide to fix the overflow and enable scroll | state | preview | | -------|------| | before | <img width="1171" height="668" alt="image" src="https://github.com/user-attachments/assets/bdbb905e-0ea9-4cde-b20b-84b4ef9a4137" /> | | after | <img width="1171" height="668" alt="image" src="https://github.com/user-attachments/assets/9e062222-1dad-49da-bdbe-616d89703301" /> | ## Test 1. visit [/docs/guides/observability/log-field-reference](https://supabase.com/docs/guides/observability/log-field-reference?queryGroups=source&source=edge_logs) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Improved table rendering in the log field reference documentation. - Updated documentation tables to use the shared table presentation for a more consistent layout. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-11 17:40:53 +03:00
Han QiaoandClaude	85573164f4	docs: document that branches are secure by default (#50193) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update ## What is the current behavior? The branching docs don't mention that new branches are created without default privileges on the `public` schema. Linear: BRA-189 ## What is the new behavior? - Working with branches: new "Default privileges on branches" section covering the keep-enabled path (initial migration grants) and the revoke path (new migration). - Troubleshooting: new entry for `42501` permission denied errors on a new branch. ## Additional context None. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added troubleshooting guidance for permission-denied errors affecting tables or functions on new branches. - Explained how migrations can restore intended default privileges on the `public` schema. - Added workflows for retaining or revoking default privileges, including dashboard configuration, migration-history repair, and access-management steps. - Added examples for granting or revoking access to sequences, functions, and tables. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-09-11 16:27:37 +08:00
6 people	4f10a55983	docs: add troubleshooting guide for password auth failures after rotation (#50122) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update (new troubleshooting entry + cross-links). ## What is the current behavior? There's no public troubleshooting entry for a transient `password authentication failed` (`28P01`) error through the Shared Pooler (Supavisor) right after a database password rotation. The closest existing entry only covers the IP-lockout circuit-breaker case (`FATAL: Circuit breaker open`), and the generic FAQ answer for "FATAL: Password authentication failed" in `connecting-to-postgres.mdx` reads as "your credentials are simply wrong," with no mention that this is expected right after a legitimate rotation. ## What is the new behavior? - New entry: `supavisor-error-password-authentication-failed-after-password-rotation.mdx` — explains this is expected, by-design pooler-cache behavior (not a bug), scopes it to SCRAM/password auth (not JIT), and walks through confirming the new password via a direct connection before contacting support. - Cross-links added from the existing circuit-breaker entry, the "How do I reset my Supabase database password?" entry, and the FAQ in `connecting-to-postgres.mdx`. ## Additional context Prettier check passes on all 4 touched files. `lint:mdx` (`supa-mdx-lint`) could not be run locally due to a pre-existing, unrelated native-module issue (`node-pty` missing its compiled binary for this platform) — expected to run in CI. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation * Added troubleshooting guidance for `28P01` password authentication failures after database password rotation. * Clarified Shared Pooler credential-refresh behavior, affected connection patterns, the built-in `postgres` role, and unaffected JIT access-token connections. * Added steps to verify credentials, retry connections, handle rate limits, and avoid repeated rotations. * Added guidance for updating credentials across live application instances and cross-references between related troubleshooting guides. <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Changed docs * the new guide: [docs-git-docs-supavisor-password-rotation-troub-026280-supab/…/supavisor-error-password-authentication-failed-after-password-rotation](https://docs-git-docs-supavisor-password-rotation-troub-026280-supabase.vercel.app/docs/guides/troubleshooting/supavisor-error-password-authentication-failed-after-password-rotation) * mention the new guide + info on auth_error Circuit Breaker [docs-git-docs-supavisor-password-rotation-troub-026280-supabase.vercel.app/docs/…/fatal-password-authentication-failed](https://docs-git-docs-supavisor-password-rotation-troub-026280-supabase.vercel.app/docs/guides/troubleshooting/fatal-password-authentication-failed) * mention the new guide: [docs-git-docs-supavisor-password-rotation-troub-026280-supabase.vercel.app/docs/…/how-do-i-reset-my-supabase-database-password…](https://docs-git-docs-supavisor-password-rotation-troub-026280-supabase.vercel.app/docs/guides/troubleshooting/how-do-i-reset-my-supabase-database-password-oTs5sB) * mention of the new guide: [docs-git-docs-supavisor-password-rotation-troub-026280-supabase.ver/…/supavisor-error-circuit-breaker-open-after-password-rotation…](https://docs-git-docs-supavisor-password-rotation-troub-026280-supabase.vercel.app/docs/guides/troubleshooting/supavisor-error-circuit-breaker-open-after-password-rotation-0fdb72) --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Nik Richers <nrichers@gmail.com> Co-authored-by: felipe stival <14948182+v0idpwn@users.noreply.github.com> Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>	2026-09-11 10:03:14 +02:00
Gildas GarciaandAlaister Young	9b1dddde11	Scoped PAT: add api_gateway_keys_secret_read and data_api_config_secret_read permissions (#50134) ... ## What kind of change does this PR introduce? Surface the new scoped personal access token permissions published in `@supabase/shared-types` 0.1.95 (added by https://github.com/supabase/platform/pull/38060, now deployed). **Stacked on #50234**, which regenerates the Management API types so Studio's scope type includes the new ids. This PR targets that branch and will retarget to `master` when it merges. ## What's in here - Bump `@supabase/shared-types` to 0.1.95 (Studio and shared-data). - Catalog entries in `packages/shared-data/scoped-access-token-permissions.ts`: - **API Key Secrets** (`api_gateway_keys_secret_read`): gates `?reveal=true` on the API keys endpoints. Renamed from "JWT secret", which described the wrong thing. - **Data API JWT Secret** (`data_api_config_secret_read`): gates the `jwt_secret` field on the PostgREST config endpoint. - **Compute** (`workers_read` / `workers_write`): shared-types 0.1.95 also publishes the workers scopes, so they surface in the catalog now. Named to match Studio's product naming (#50208). - Minimum roles for the four new ids in `FGA_SCOPE_MINIMUM_ROLE`, transcribed from the OpenFGA model (secret reads: developer; workers read: readonly; workers write: developer). - Docs generator (`generateAccessControlPartials.mts`): - Drop the workers exclusion now that the scopes are live. - When an endpoint lists alternative permission sets (for example API keys read alone, or read plus secret read for reveal), a row's footnote now only considers the alternatives that include that row's own scope. Previously the API Key Secrets row would have said "Requires API Keys (Read), or API Keys (Read) and API Key Secrets (Read)". - Regenerated PAT guide tables. The committed Management API specs predate the secret scopes, so this also includes the same spec refresh the weekly docs bot performs (`chore(docs): refresh the Management API specs`, kept as its own commit). Besides the new rows it picks up two new upstream endpoints under Advisors and the branch rows. ## Verified - `pnpm --filter studio typecheck` clean on top of #50234. - Access token test suite passes, including the guard that the role table covers exactly the ids shared-types publishes. - Partial regeneration is idempotent, so the Docs Tests stale-table gate passes. ## Follow-ups (not in this PR) - `apps/docs/content/guides/getting-started/api-keys.mdx` says a fine-grained token needs `api_gateway_keys_read` for the `?reveal=true` example. It now also needs `api_gateway_keys_secret_read`. - `project:api_gateway_keys` still says "Read exposes API keys" in its risk reason, which overstates it now that secret values sit behind a separate scope. Rewording may mean revisiting its risk level. - The comment in `ComputeLayout.tsx` about shared-types not exposing `workers_read` is stale. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added permission support for API key secrets, Data API JWT secrets, and compute workers. * Added API endpoints to run project advisors and create branches. * Added support for additional log-drain destinations, including S3, Last9, and OTLP. * Added storage object versioning information to project configuration responses. * **Documentation** * Updated access-control documentation for new permissions, worker operations, advisor runs, and branch creation. * Clarified Data API configuration and secret descriptions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-09-11 13:31:21 +08:00
Katerina Skroumpelou	028e05205b	docs: warn that default signOut scope revokes all sessions (#50119) ... Warn that default signOut scope revokes all sessions. Motivation: https://github.com/supabase/ssr/issues/68 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Clarified that signing out without a specified scope ends all sessions by default. * Added guidance for using a local sign-out scope to preserve sessions on other devices and browsers. * Documented the invalid refresh token errors that may occur when other sessions are revoked. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-10 12:37:06 +00:00
Anthony Lio	de2f8bbd03	fix(docs): prima guide yarn panel display npx (#50186) ... ## What kind of change does this PR introduce? bug fix in prisma guide page code example ## What is the current behavior? yarn panel display `npx` command in code example ## What is the new behavior? favor `yarn` command in yarn panel code example | state | preview | | -------|------| | before | <img width="760" height="315" alt="image" src="https://github.com/user-attachments/assets/d7dc9004-9618-48ff-9b6c-4b7da4e8c44e" /> | | after | <img width="760" height="315" alt="image" src="https://github.com/user-attachments/assets/a7cee65f-2038-4f5a-81e3-1cb627cb73b9" /> | ## Test 1. visit `/docs/guides/database/prisma` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated Yarn Prisma command examples to use Yarn-specific syntax for project initialization, migrations, database pulls, migration diffs, migration resolution, and client generation. * npm, pnpm, and Bun examples remain unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-10 10:58:37 +03:00
Miranda Limonczenko	bc102876bb	docs: apply the rest of the connecting to Postgres feedback (#49928) ... Closes FDBKIN-31335 Closes FDBKIN-13040 Closes FDBKIN-8653 Closes FDBKIN-19912 Closes DOCS-740 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. While we are revising this document, this PR gathers docs feedback via AI magic and applies that feedback. ## What is the current behavior? These findings stand on feedback intake rather than on the baseline. Worth doing, and the eval won't show a score change for any of them. - **Nothing explains the pooler host.** #49868 switched the strings to `[POOLER-HOST]`, but the page never says why you can't compose the host, and agents that recite `aws-0` get `Tenant or user not found`. agent-skills#92. - **The page gives the instruction to turn prepared statements off, but not the flag.** It also links the GitHub discussion rather than the troubleshooting entry that mirrors it. FDBKIN-8248, FDBKIN-7883. - **SSL goes undiscussed.** Four of six eval runs set `ssl: 'require'` unprompted. - **The pooled username format only appears inside example strings**, never as a rule. DOCS-740, FDBKIN-19912. - **Third-party tools have no answer.** Session mode is the right one, and the decision table had no row for a BI client or database GUI at all. FDBKIN-8653. - **Only one of transaction mode's three limitations is documented.** FDBKIN-13040 names prepared statements, cursors, and session-level settings. The page covered prepared statements. ## What is the new behavior? - Tell the reader to copy the host, port, and username rather than typing the placeholders, and explain the pooler cluster index next to the reference table. The placeholders themselves changed in #49868. - State the username rule: direct connections and the dedicated pooler use `postgres`, shared pooler connections use `postgres.<project-ref>`. - Add a per-driver prepared statements table for Postgres.js, Drizzle, Prisma, asyncpg, and JDBC, and link [Disabling prepared statements](https://supabase.com/docs/guides/troubleshooting/disabling-prepared-statements-qL8lEL) for the rest. Add JDBC's `prepareThreshold=0` to that entry too, so the two pages agree. - Document SSL: `require` rather than the `prefer` default, which falls back to plaintext. - Link the `CONNECT_TIMEOUT` entry for stale sockets in frozen serverless runtimes. - Add a decision table row for a third-party tool, and point at Quickstarts for named tools. - Cover all three transaction mode limitations. Cursors work inside a single transaction only, and session-level state is lost between transactions: `set` and `reset`, session-level advisory locks, `listen` and `notify`, and temporary tables. Renamed the section from "Prepared statements", since it now covers the cause rather than one symptom. - Promote Configure your client to an H2 and fold the SSL certificate section into it. The table of contents only renders H2 and H3, so the client settings were invisible as H4s. ## Manual testing 1. Open [Connect to your database](https://docs-git-docs-connecting-to-postgres-technical-supabase.vercel.app/docs/guides/database/connecting-to-postgres) on the deploy preview. 2. Read the Get your connection string lead-in. It tells you to copy the host, port, and username rather than typing the placeholders. 3. Check the table of contents. Configure your client is an H2 with Application-side pool size, Prepared statements, SSL, and Stale connections under it. 4. Follow the prepared statements link. It lands on the in-docs troubleshooting entry, not GitHub. 5. Open the [endpoint reference](https://docs-git-docs-connecting-to-postgres-technical-supabase.vercel.app/docs/guides/database/connecting-to-postgres#endpoints-and-ip-versions). The table shows `aws-[INDEX]-[REGION]`, and the prose below explains the index and the username rule. 6. Read the decision table. It has a row for a third-party BI client or database GUI, pointing at session mode. 7. Read [Transaction mode limitations](https://docs-git-docs-connecting-to-postgres-technical-supabase.vercel.app/docs/guides/database/connecting-to-postgres#transaction-mode-limitations). It covers prepared statements, cursors, and session-level state. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation - Expanded the Postgres connection guide with clearer client configuration guidance, including pool sizing, SSL, stale connections, and transaction mode limitations. - Added recommendations for BI tools and database GUIs using the shared pooler. - Clarified connection strings, pooler hosts, usernames, ports, and IP version behavior. - Updated serverless driver guidance for transaction mode configuration. - Added JDBC troubleshooting instructions for disabling prepared statements with `prepareThreshold=0`. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-09 16:49:42 -07:00
Miranda Limonczenko	15484a0e75	docs: add application-side pool sizing to the connecting to Postgres guide (#49927) ... Closes DOCS-1312 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. One technical addition, isolated so the eval can attribute a score change to it. I re-ran the preview link on a scratch Eval branch and found that this PR will resolve the Eval. ## What is the current behavior? The eval baseline for `build-docs-004-postgres-connection` fails one check, 3 of 6 runs: the application-side pool cap for a serverless invocation. - Two failing runs left `max` unset, which is 10 on the Postgres.js default. - One set `max: 5`. The page says nothing about the application-side pool, so there was nothing for an agent to read. Every other check passes 6/6, including the connection string, port, username, and prepared statements. The mode choice already transmits from the page. Baseline notes are on [DOCS-1312](https://linear.app/supabase/issue/DOCS-1312). ## What is the new behavior? Add a **Configure your client** section to the procedure group. Pool sizing is its only subject. - Set the application-side pool to 1 connection per serverless invocation, and raise it only on evidence. - Name the trap concretely. Library defaults assume a persistent backend, and 10 connections is 10 per warm instance, with the instance count outside your control. - One Postgres.js sample setting `max` and `prepare`, created at module scope. - Cite the [Supavisor FAQ](https://supabase.com/docs/guides/troubleshooting/supavisor-faq-YyP5tI) and [Prisma troubleshooting](https://supabase.com/docs/guides/database/prisma/prisma-troubleshooting), which already carries the equivalent `connection_limit` guidance for one ORM. The gap is that the connection guide didn't carry it for readers not using Prisma. `prepare: false` is in the sample because a transaction mode sample is wrong without it, and the page already instructs it. It isn't new guidance. `ssl: 'require'` is, so it waits for #49928. ## Additional context PR 3 of 4. Base is #49869. This ships alone on purpose. It's the only change with baseline evidence behind it, so a score change after this PR is attributable to one edit. #49928 carries the rest of the eval feedback and is not expected to move the score. **Run the eval against this preview before #49928 lands.** ## Manual testing 1. Open [Connect to your database](https://docs-git-docs-connecting-to-postgres-pool-size-supabase.vercel.app/docs/guides/database/connecting-to-postgres) on the deploy preview. 2. Check the table of contents. "Configure your client" appears under Get your connection string. 3. Read the section. It states 1 connection per invocation and names the Postgres.js default of 10. 4. Read the sample. It sets `max: 1` and `prepare: false`, and says the client is created once at module scope. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added guidance for configuring application-side Postgres clients when connecting through Supabase poolers. - Documented recommended serverless settings, including creating the client once, limiting connections per invocation, and disabling prepared statements in transaction mode. - Added a Postgres.js configuration example and links to relevant Supavisor FAQ and Prisma troubleshooting resources. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-09 16:39:09 -07:00
Palash AwasthiandNik Richers	165582b08e	docs: add Reflex framework quickstart (#45441) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update — adds a new framework quickstart. ## What is the current behavior? The Framework Quickstarts section under Getting Started covers Next.js, Nuxt, React, Flask, and others, but doesn't include Reflex (https://reflex.dev), an open-source Python web framework that compiles to React. Python developers building full-stack apps with Reflex have to piece together the Supabase setup from the general Python reference rather than following a quickstart. ## What is the new behavior? Adds a Reflex framework quickstart at `apps/docs/content/guides/getting-started/quickstarts/reflex.mdx`, mirroring the structure of the existing Flask quickstart: same DB setup partial (`quickstart_db_setup.mdx`), same env var step using `ProjectConfigVariables`, same six-step `StepHikeCompact` shape. A nav entry is added directly after Flask in `NavigationMenu.constants.ts`, gated on `!jsOnly` to match Flask's pattern. Verified end-to-end against a fresh Supabase project: ran every command in the docs literally, including the full SQL from `quickstart_db_setup.mdx` (with the `grant select on public.instruments to anon` line). The rendered Reflex app shows the Instruments heading with all three seeded rows. No console errors, no event-loop warnings. ## Additional context Conventions used in the quickstart: - Uses `uv` (`uv init`, `uv add`, `uv run`) rather than pip + venv. This follows the broader docs pattern of each quickstart using its framework's idiomatic tooling (Next.js → npx, RedwoodJS → yarn, Laravel → composer, Flutter → pubspec.yaml). It also matches what Reflex's own `reflex init` post-install message recommends. `uv add` produces a `pyproject.toml` and `uv.lock` so users can rebuild deterministically with `uv sync`. - The Supabase client is constructed via `acreate_client` with a lazy-init pattern, and the event handler is `async def`. This avoids blocking Reflex's event loop on the HTTP request. In touch with the Supabase team on this — happy to iterate on copy or scope based on review. Pre-flight: ran pnpm run format locally, which passed cleanly. Did not run pnpm run build locally — hit a Windows/CRLF-related TOML parsing failure in an unrelated troubleshooting frontmatter file (apps/docs/content/troubleshooting/all-about-supabase-egress-a_Sg_e.mdx) during page data collection. Relying on Vercel preview to validate the build. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Reflex (Python) and Spring Boot to the framework quickstarts. * Reorganized quickstart listings for clearer framework navigation and grouping. * **Documentation** * Added a Reflex quickstart guide covering Supabase setup, environment variables, asynchronous data loading, error handling, and running the app. * Added Reflex-specific AI guidance for configuring Supabase projects. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Nik Richers <nik@validmind.ai>	2026-09-09 23:35:24 +00:00
Miranda Limonczenko	976e7338bc	docs: restructure the connecting to Postgres guide by information type (#49869) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Restructure, mostly moved lines, plus inbound anchor fixes. ## What is the current behavior? The page states the same routing decision four times and never states an answer: - Intro bullets - A matrix table - A "How to choose the right connection method?" section - A Mermaid flowchart An agent asked "I'm deploying to Vercel serverless functions, set up the database connection" has to synthesize an answer from four partial, inconsistent restatements. Context, procedure, and reference material are interleaved throughout, so background reading interrupts the action path. The page is also too long at 2,883 words, and grouping alone doesn't fix that. Explainer and reference material need their own page, and the troubleshooting group belongs in troubleshooting entries. 16 of the 19 inbound anchor links to this page are already broken on `master`, before any restructure: `#direct-connections`, `#shared-pooler`, `#connection-pooler`, `#how-connection-pooling-works`, `#quick-summary`, `#connection-pool`, and `#connecting-with-drizzle`. Groundwork for [DOCS-1312](https://linear.app/supabase/issue/DOCS-1312). The issue stays open until the paired eval is re-run. ## What is the new behavior? Group the guide into a decision, a procedure, context, reference, and troubleshooting, per CONTRIBUTING § Guides on mixed information types. Review with `git diff --color-moved=zebra`. - Lead with "Which connection method do you use?", a decision table keyed on where your code runs. Section navigation sits directly below the intro. - Collect every connection string under "Get your connection string", with the shared Connect dialog steps stated once as a procedure. - Move the endpoint, port, pool size, and connection limit material into "Connection reference". These were FAQ questions. - Split the page. The guide keeps the decision, the connection strings, and the quickstarts, at 1,180 words and three paths. A new child page, Connection pooling and limits, carries how pooling works, pool size, connection limits, and monitoring. - Move the endpoint and IP version table up beside the connection strings it explains. - Replace the troubleshooting group with two new troubleshooting entries, `tenant-or-user-not-found` and `fatal-password-authentication-failed`, plus links to the existing entries. The existing connection-refused entry is stronger than what was here: it names the IP ban and gives the unban procedure. - Cut the pool size worked example. It said a pool size of 30 is a shared ceiling across session and transaction mode, while the Supavisor FAQ and the terminology entry both say pool size is per user, database, and mode combination. That text came from `master`, so the contradiction is pre-existing. Link the FAQ as the authority rather than picking a side. - Drop the duplicate `pg_stat_ssl` query, which already exists in `connection-management.mdx` and `monitor-supavisor-postgres-connections.mdx`, both with column tables this page lacked. - Add the subsection to the navigation, which also adopts `connecting-to-postgres/serverless-drivers`. That page existed on disk and was referenced nowhere in the navigation constants. - Delete the decision flowchart. It was the fourth restatement of the decision table, and its logic was broken: `Persistent Backend` had two unconditional edges into decision nodes that each had one unlabeled output, so neither node decided anything. - Fix every broken inbound anchor, and pin stable anchors on the headings they target. This now includes six files in `apps/www` that no earlier pass in this stack checked, most of which were already broken on `master`. - Repoint the Studio Connect sheet's Drizzle link at the Drizzle guide. It pointed at a heading this page hasn't had for some time. - Serverless drivers: state the guide's intent, give the three runtimes parallel structure, and link the transaction mode prepared statements constraint. That page never mentioned the constraint that most affects serverless connections. ## Additional context PR 2 of 2. Base is #49868, rebased on its review feedback commit. Three of the 13 files are in `apps/studio`, so this runs the Studio unit tests, build, and lint ratchet. They are link string changes only. The ESLint warning count is unchanged at 1 on the touched files, so the ratchet holds. ## Manual testing 1. Open [Connect to your database](https://docs-git-docs-connecting-to-postgres-structure-supabase.vercel.app/docs/guides/database/connecting-to-postgres) on the deploy preview. 2. Check the table of contents. The top level reads: Which connection method do you use?, Get your connection string, Quickstarts, Related. The intro lists three paths. 3. Open [Reports](https://docs-git-docs-connecting-to-postgres-structure-supabase.vercel.app/docs/guides/monitoring-and-debugging/reports) and follow "Implement connection pooling" under Disk IO. It lands on the decision table. 4. Open [Serverless drivers](https://docs-git-docs-connecting-to-postgres-structure-supabase.vercel.app/docs/guides/database/connecting-to-postgres/serverless-drivers). The intro links the transaction mode prepared statements constraint. 5. Check the sidebar. Connecting to your database expands to Connection pooling and limits and Serverless drivers. 6. Open [Connection pooling and limits](https://docs-git-docs-connecting-to-postgres-structure-supabase.vercel.app/docs/guides/database/connecting-to-postgres/pooling-and-limits). Pool size states the setting and links the Supavisor FAQ, with no worked example. 7. Open [Tenant or user not found](https://docs-git-docs-connecting-to-postgres-structure-supabase.vercel.app/docs/guides/troubleshooting/tenant-or-user-not-found). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a dedicated guide covering connection pooling, limits, configuration, and monitoring. * Added troubleshooting guides for password authentication failures and shared pooler tenant or user errors. * Expanded connection guidance with method selection, endpoints, IP versions, and serverless driver configuration. * **Documentation** * Reorganized database connection documentation and navigation. * Updated related links throughout the documentation to current connection and pooling guidance. * Improved guidance for pooler modes, connection strings, and supported deployment environments. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-09 16:21:41 -07:00
Miranda Limonczenko	7fbaeb3dcd	docs: style edit for the connecting to Postgres guide (#49868) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Style only. ## What is the current behavior? The connecting to Postgres guide and its serverless drivers child page have drifted from `WORD_LIST.md` and `CONTRIBUTING.md`. They also carry six defects: - The connection pooling diagram's alt text describes migrations on a preview instance. - The SSL screenshot's alt text and the sentence above it both promise connection info. The image shows the SSL Configuration panel: a toggle and a Download Certificate button. - "Where can you see current connection usage?" lists three Observability reports, then says the Roles page is not real-time. The Roles page appears nowhere else in that answer. - The serverless drivers manual configuration step has no main clause. - "For example, If you set the pool size to 30". - One of the two monitoring queries uses uppercase SQL keywords. Three of the four connection strings use `postgres://` and two carry literal project refs. The Connect dialog emits `postgresql://` with placeholders. The pooler host is templated as `aws-[region]`, which reads as composable and isn't. Hosts are `aws-<index>-<region>.pooler.supabase.com`, and the index is a pooler cluster index, not part of the region. Both `aws-0-us-west-1` and `aws-1-us-west-1` appear in this repo, so a reader can't derive it. Studio doesn't compose the host either; it comes from the API. Groundwork for [DOCS-1312](https://linear.app/supabase/issue/DOCS-1312). The issue stays open until the paired eval is re-run. ## What is the new behavior? Word-level edit. No section is added, moved, or reordered, so the restructure in the next PR of this stack lands as a readable set of moved lines. Headings are untouched; PR 2 owns all heading changes. - Fix the six defects above. - Align the connection strings with what the Connect dialog emits: `postgresql://` on all four, and `[PROJECT-REF]` in place of two literal project refs. - Use `[POOLER-HOST]` in the copyable pooler strings, the convention the newer quickstarts already use. Keep the full `aws-[INDEX]-[REGION]` shape in the summary table, where showing the shape is the point. - Settle on one name per concept: shared and dedicated pooler in sentence case, persistent backend, serverless and edge functions, and paid plans. - Drop bold used for plain emphasis, parenthetical asides, and claims the page doesn't support: "ideal for", "ensures best performance and latency", "satisfactory on their own". - Format the two literal error strings as code, not quotes. - Split the pool size answer into one paragraph per subject, and turn the two pooler limits into a table. - Serverless drivers: sentence case title, an intent sentence, and a four-step procedure in place of the sentence fragment. ## Additional context PR 1 of 2. Base is `master`. Second commit applies review feedback. Third fixes the pooler host placeholder, which belongs here rather than later in the stack: the evidence is in the repo, not in the eval. ## Manual testing 1. Open [Connect to your database](https://docs-git-docs-connecting-to-postgres-style-supabase.vercel.app/docs/guides/database/connecting-to-postgres) on the deploy preview. 2. Read the four connection strings. All four use `postgresql://`, and the two pooler strings use `[POOLER-HOST]` rather than a composable region template. 3. Inspect the two images. The pooling diagram's alt text describes pooling, and the SSL screenshot's describes the SSL Configuration panel. 4. Read "Where can you see current connection usage?". The paragraph after the report list refers to the reports, not the Roles page. 5. Read "What is the difference between client connections and backend connections?". The two limits are a table. 6. Open [Serverless drivers](https://docs-git-docs-connecting-to-postgres-style-supabase.vercel.app/docs/guides/database/connecting-to-postgres/serverless-drivers). Manual configuration is four numbered steps. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified the PostgreSQL connection guide with updated connection examples, pooling guidance, connection-mode tables, SSL information, FAQs, and SQL formatting. - Replaced sample connection values with generic placeholders in documentation examples. - Added clearer guidance that frontend Data API access requires appropriate RLS policies. - Updated explanations of client/backend connections and long-lived PostgreSQL sessions. - Updated serverless driver documentation with clearer setup guidance for Vercel, Cloudflare, and Supabase Edge Functions. - Reorganized manual configuration into numbered steps and standardized connection string examples. - Improved descriptions of runtime behavior and supported connection methods. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-09 15:24:02 -07:00
Andrey A.	8c7a4d9dbb	chore(self-hosted): update 2026-09-09 - 0.8.1 (#50172)	2026-09-09 15:45:54 +02:00
Ferhat Elmas	83c33e903c	docs(storage): topK 10_000 and nextToken (#50087) ... Signed-off-by: Ferhat Elmas <elmas.ferhat@gmail.com>	2026-09-09 13:03:07 +02:00
4 people	c75e213ade	[bot] Sync from supabase/troubleshooting (#49906) ... This PR syncs the latest troubleshooting guides from the supabase/troubleshooting repository. --------- Co-authored-by: github-docs-bot <github-docs-bot@supabase.com> Co-authored-by: Nik Richers <nrichers@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-08 21:24:10 +00:00
ŁUKASZ KORBASIEWICZ	8121df5b0a	docs: correct Auth rate limit details (#49772) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update ## What is the current behavior? The Auth rate-limit table contains stale customization statuses and time windows, omits SMS and Web3 limits, and describes the anonymous sign-in burst incorrectly. ## What is the new behavior? - Aligns documented limits with the current Auth, Studio, and Management API behavior - Documents SMS, Web3, and sign-up/sign-in request limits - Corrects verification, token, MFA, email, and anonymous sign-in details - Updates shared rate-limit values and units used by the docs ## Additional context Validation: - Prettier check - Focused MDX lint - Shared-data TypeScript check - All 16 SharedData references resolve <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Refined authentication rate limits with clearer per-minute and per-five-minute windows. * Added rate limits for SMS, password reset requests, and Web3 sign-ups and sign-ins. * Updated sign-in, sign-up, verification, token refresh, MFA, and anonymous sign-in limits, including customizable settings where supported. * Clarified email-sending limits and OTP behavior. * **Documentation** * Updated rate-limit reference tables and guidance on request bucket capacity and sustained traffic. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-08 18:52:22 +02:00
Anthony Lio	45199443c8	fix(ui): admonition component parity (#49925) ... ## what is the current behavior? admonition icon <> text not optically aligned + rendered differently in docs and the design system _ docs showed admonition text at 15px/28px because the page's prose styles reached inside the component, while the same callout was 13px in the design system _ lists ## what is the new behavior? - the title offset is now conditional. a title and body copy have different line heights, so they need different nudges to sit level with the icon. - fixes list markers and the ordered-list chip alignment inside callouts. - removes `.admonition-content` css that nothing referenced - fixes 5 admonition titles that were not capitalized. | state | preview | | -------|------| | before | <img width="902" height="279" alt="image" src="https://github.com/user-attachments/assets/2fffb183-81e2-4eff-8f0d-8a07649390e8" /> | | after | <img width="902" height="279" alt="image" src="https://github.com/user-attachments/assets/22abe3ed-fd6d-49ac-aa37-4292bca5850a" /> | ## follow ups - better composition: title, description and actions are still props _ a compound api (`Admonition.Title`, `Admonition.Actions`) would remove the `childProps` escape hatch <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Improved capitalization of note and warning titles in the Metabase and Prisma guides for consistency. * Updated the contributing guide’s table of contents to exclude feedback headings. * Improved heading structure for the documentation feedback section. * **UI Improvements** * Refined admonition and alert typography, spacing, list formatting, and ordered-list alignment. * Improved content spacing when titles, descriptions, or icons are present. * Updated action links and buttons for more consistent sizing. * Adjusted alert content styling for a clearer presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-08 14:31:30 +03:00
Andrey A.	bd43802d7b	docs(self-hosted): add a section about key rotation to docker guide (#50015)	2026-09-04 21:35:49 +02:00
Andrey A.	8a1adbbd14	docs(self-hosted): use opaque api keys in self-hosted how-to guides (#50000)	2026-09-04 18:34:17 +02:00
CharisandJoshen Lim	2ee0108928	studio: increase gp3 max size to new aws limit (#45611) ... <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Increased GP3 disk limits to support up to 64 TB of storage, 80,000 IOPS, and 2,000 MB/s throughput. * **Documentation** * Updated the disk comparison table to reflect the expanded GP3 limits. * **Bug Fixes** * Improved disk-size validation and recommendation messaging for clearer wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-09-04 09:39:27 -04:00
Utkarash Kumar Singh	3d2148a821	docs: add pgcrypto legacy-cipher caveat for the 15.19/17.11 upgrade (#49894) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update — follow-up to #49621 for the Postgres 15.19 / 17.11 release. ## What is the current behavior? The upgrade guide covers three of the four customer-action items for this release; the pgcrypto legacy-cipher caveat (CVE-2026-14663) was deliberately held pending Security sign-off on the wording. ## What is the new behavior? Adds a "Pgcrypto legacy PGP ciphers" section (between the Ltree and Btree_gist sections, matching the release comms order): who is affected (`bf`/`blowfish`/`cast5` only), the wrong-key decrypt probe to check stored data, the AES re-encrypt step (with `ignore-cipher-failure=1` for post-upgrade recovery), and the secret-rotation recommendation. Wording approved by Security. ## Additional context Refs PSQL-1245 / PSQL-1110. Matches the customer email draft and changelog entry wording. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated `pgcrypto` upgrade guidance to separate pre-upgrade decryption from post-upgrade recovery, including the appropriate handling for cipher failures. - Added row-based targeting and plaintext spot checks before bulk updates. - Clarified that automated wrong-key scans cover symmetric messages; public-key messages require manual identification and key-pair re-encryption. - Updated the caution note to direct users to scan stored values rather than rely on a fixed list of cipher algorithms. No action is needed when `cipher-algo` was never specified. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-04 13:31:18 +01:00
Anthony Lio	085d218bff	fix(docs): button a11y enhancements (#49952) ... ## What kind of change does this PR introduce? bug fix for accessibility, fixes [docs-1265](https://linear.app/supabase/issue/DOCS-1365/add-aria-label-to-icon-only-buttons-button-name) ## What is the current behavior? some controles in the docs app have no accessible name, so screen readers announce them as an unlabelled "button" ## What is the new behavior? - adds each control a name the way its neighbours already do - adds menu toggle a state-dependent `aria-label` and `aria-expanded` - adds `button-name` to `enforced_rules` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Accessibility** - Added descriptive labels to configuration selectors and mobile menu controls. - Mobile menu controls now announce whether the menu is open or closed. - Expanded accessibility validation to check button names across documentation pages. - **UI Improvements** - Updated the raw throughput table control with a clearer button appearance and expandable chevron indicator. - Replaced a schema-migration tooltip with a direct in-page link. - **Documentation** - Removed the Info Tooltip component guidance from the contributing documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-04 10:32:57 +03:00
4 people	e0280cb650	docs: restructure observability navigation and overview (#49505) ... <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. The troubleshooting *catalog* rewrite (`content/troubleshooting` and the Diagnosing UI) stays out of scope. 1. #49503 move inspect and advisors 2. #49501 split Studio logs from ClickHouse queries 3. #49500 treat reports as signal dashboards 4. #49502 add Observe the data hub 5. #49506 add agent setup components 6. #49504 add hire-an-agent templates 7. **#49505** restructure observability nav, overview, Detecting, and flatten Observe the data ← **this PR** ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Top layer in the observability stack. ## What is the current behavior? The section is still titled Monitoring and Debugging, with a Debugging / Monitoring split that does not match the new pages. The debugging guide is still the master layer-isolation + symptom table. Observe the data is split into “what data” vs “where to observe it,” which duplicates the source pages. ## What is the new behavior? - Section title is Observability - Overview groups Observe the data, Detect and resolve, Hire an agent, and Export - **Observe the data is flattened by source.** Logs, Metrics API, Database, Advisors, and Reports each list where to read that source. There is no separate MCP/API/CLI/Studio nav group. - **Observe vs Detecting:** Observe is the catalog (what exists, how to access it). Detecting is how to *use* those sources to pick up a Health / Security / Performance / Usage signal. Named errors skip to Diagnosing. - Studio Logs sits under Logs. Reports sits beside the other sources. - Troubleshooting stays in the global menu and also appears as Diagnosing under Detect and resolve ## Additional context This is the last PR in the stack. Together the seven PRs reconstruct the `docs/monitoring` observability IA and guide content, without shipping the troubleshooting catalog overhaul. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Nik Richers <nik@validmind.ai>	2026-09-04 13:38:39 +10:00
4 people	6f2effd9e2	docs: add hire-an-agent templates for observability routines (#49504) ... <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. Troubleshooting / debugging-guide rewrite is out of scope. 1. #49503 move inspect and advisors 2. #49501 split Studio logs from ClickHouse queries 3. #49500 treat reports as signal dashboards 4. #49502 add Observe the data hub 5. #49506 add agent setup components 6. **#49504** add hire-an-agent templates ← **this PR** 7. #49505 restructure observability nav and overview ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Sixth layer in the observability stack. ## What is the current behavior? Humans and agents have no packaged, copy-paste observability routines to run in their own harness. ## What is the new behavior? - Hire an agent hub plus Doctor, Security officer, Personal trainer, and Accountant - Each page is a prompt + schedule + harness setup (Claude, Codex, Cursor) - MCP security guidance covers unattended read-only monitoring on production ## Additional context These pages are the agent-facing templates from the prototype. #49505 puts them in the Observability overview and sidebar. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Steven Eubank <eubank.steven88@gmail.com>	2026-09-04 13:38:38 +10:00
3 people	4c716df063	docs: add Observe the data hub for logs, metrics, and advisors (#49502) ... <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. Troubleshooting / debugging-guide rewrite is out of scope. 1. #49503 move inspect and advisors 2. #49501 split Studio logs from ClickHouse queries 3. #49500 treat reports as signal dashboards 4. **#49502** add Observe the data hub ← **this PR** 5. #49506 add agent setup components 6. #49504 add hire-an-agent templates 7. #49505 restructure observability nav and overview ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Fourth layer in the observability stack. ## What is the current behavior? There is no single page that maps what you can observe (logs, metrics, database, advisors) to where you query it (MCP, API, CLI, Studio). ## What is the new behavior? Adds `/guides/monitoring-and-debugging/access-data` as that hub, with content listings and nav. Inspect and Query and filter logs now point here for MCP/CLI context. ## Additional context This page is the spine of the new observability IA. Later PRs add agent templates and restructure the sidebar around it. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com>	2026-09-04 13:38:37 +10:00
4 people	5a676e2a86	docs: split Studio logs from ClickHouse log queries (#49501) ... <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. Troubleshooting / debugging-guide rewrite is out of scope. 1. #49503 move inspect and advisors 2. **#49501** split Studio logs from ClickHouse queries ← **this PR** 3. #49500 treat reports as signal dashboards 4. #49502 add Observe the data hub 5. #49506 add agent setup components 6. #49504 add hire-an-agent templates 7. #49505 restructure observability nav and overview ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Second layer in the observability stack. ## What is the current behavior? `/guides/monitoring-and-debugging/logs` mixes the Studio Logs UI with ClickHouse query syntax, sources, and recording extra events. ## What is the new behavior? - Logs is the Studio interface guide (filters, log types, inspecting a row) - Query and filter logs (`advanced-log-filtering`) owns ClickHouse SQL, sources, MCP/API/CLI access, and recording extra Postgres/API/Realtime events - Log field reference explains `log_attributes` query paths - Nav labels and cross-links follow the new titles ## Additional context Forward links to the later Observe the data hub are added in #49502. ## Self-review - Existing `#querying-with-the-logs-explorer` and `#configuring-pgauditlog` anchors now live on Query and filter logs - Debugging-guide links that pointed at the old Logs Explorer heading were retargeted so they still resolve <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Nik Richers <nik@validmind.ai>	2026-09-04 13:38:36 +10:00
4 people	0bbd64743c	docs: move inspect and advisors into observability (#49503) ... <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. Troubleshooting / debugging-guide rewrite is out of scope. 1. **#49503** move inspect and advisors ← **this PR** 2. #49501 split Studio logs from ClickHouse queries 3. #49500 treat reports as signal dashboards 4. #49502 add Observe the data hub 5. #49506 add agent setup components 6. #49504 add hire-an-agent templates 7. #49505 restructure observability nav and overview ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. First layer in the observability stack. ## What is the current behavior? Inspect and advisors live under Database (`/guides/database/inspect`, `/guides/database/database-advisors`). Observability readers have to leave the monitoring section to find them. ## What is the new behavior? - Moves inspect into `/guides/monitoring-and-debugging/inspect` - Adds `/guides/monitoring-and-debugging/advisors` (replaces the Database Advisors page) - Adds redirects and updates Studio/docs links so old URLs keep working - Adds both pages to the existing Monitoring nav so they are discoverable before the later IA PR ## Additional context Inspect and advisors pages render as standard MDX. Redirects cover `/docs/guides/database/inspect`, `/docs/guides/database/database-advisors`, and `/docs/guides/database/database-linter`. Debugging-guide content is unchanged except the inspect URL. ## Self-review - No leftover `/guides/database/inspect` or `/guides/database/database-advisors` links in docs guides or Studio linter/AI surfaces (historical blog posts left as-is) - Smoke test path updated to `/docs/guides/monitoring-and-debugging/advisors` <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a centralized Advisors guide for security and performance checks. - Updated database inspection guidance with live Postgres statistics, cache hit-rate context, and query-analysis resources. - **Documentation** - Reorganized Advisors and database inspection content under Monitoring and Debugging. - Updated navigation, cross-references, in-product help links, and CLI documentation links. - Added permanent redirects from previous documentation URLs to preserve access. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Nik Richers <nik@validmind.ai>	2026-09-04 13:38:36 +10:00
Danny White	24be387cdb	docs: use sign in terminology across guides and style guides (#49877) ... ## What kind of change does this PR introduce? Docs update. Aligns documentation and style guides with the **Sign in / Sign out / Sign up** platform standard. Closes DOCS-1328. Related to [#49874](https://github.com/supabase/supabase/pull/49874). ## What is the current behavior? Docs style guides prefer _login_ / _log in_. Guide prose uses mixed login and sign in wording. ## What is the new behavior? - [WORD_LIST.md](apps/docs/WORD_LIST.md) and [copywriting.mdx](apps/design-system/content/docs/copywriting.mdx) document the sign in standard - Design-system auth examples updated - Guide prose and API reference spec descriptions updated ### Terminology **Standard:** Use _sign in_, _sign out_, and _sign up_ as verbs. Use _sign-in_, _sign-out_, and _sign-up_ as nouns and adjectives. Match Studio UI labels (**Sign in**, **Sign out**, **Sign up**). **Preserved intentionally:** | Category | Keep as-is | Example | | -------- | ---------- | ------- | | Feature name | social login | `/social-login`, `features.mdx` heading, OAuth provider section | | URL slugs | `login` in paths | `/phone-login`, `/login-flows`, `choosing-login-flow` | | CLI | `supabase login` / `supabase logout` | Reference ids `supabase-login` / `supabase-logout`; executable commands unchanged | | SDK methods | `logout()` | Kotlin/Swift method names in API reference titles and examples | | Third-party UI | Provider product labels | Facebook Login, Kakao Login, portal **Login** buttons | | Postgres | Database terminology | login privileges, login credentials, login via role | | Audit/logging | Log prose | "Generates the following **log** in the Postgres Logs" | | Code and routes | Paths and filenames | `app/login/`, `Login.tsx`, `demos/android-login` | | External URLs | Third-party login pages | `dash.cloudflare.com/login`, `console.neon.tech/login`, `vercel.com/login` | | API identifiers | Event and field names | Audit actions `login`/`logout`, `should_logout_user` | ## To test - Run `pnpm lint:mdx` in `apps/docs` - Spot-check `features.mdx`, `social-login.mdx`, and a provider guide (e.g. Facebook, Kakao) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Standardized authentication terminology across guides, reference material, CLI documentation, and copywriting guidance using “sign in,” “sign out,” and “sign up.” * Updated authentication instructions, headings, link text, examples, and SSO guidance for clearer, more consistent wording. * Corrected related grammar, spelling, hyphenation, and documentation links while preserving established product names and implementation commands. * **Style** * Refined code examples with consistent import ordering and spacing. * **Examples** * Updated authentication button and menu labels to “Sign in” and “Sign out.” <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-04 09:10:25 +10:00
Katerina Skroumpelou	bdfd69e955	docs(api): note db.schema generic requirement for TS (#49967) ... Adds a note to the "Using Custom Schemas" guide: `createClient<Database>(...)` needs the schema passed as the second generic (`createClient<Database, 'myschema'>(...)`) to type-check `db.schema` against anything but `public`. `supabase.schema('myschema').from(...)` is the per-call alternative that needs no second generic. Related to supabase/supabase-js#969 — the existing JS example has no type parameters so it never surfaces this, and TypeScript users extending it with `<Database>` hit a confusing compile error with no pointer to the fix. supabase-js companion: supabase/supabase-js#2662 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added guidance to the custom schemas guide explaining TypeScript typing behavior when using non-public schemas. * Clarified how to specify a schema explicitly and when schema types are inferred automatically. * Noted that custom schemas must be included in the generated `Database` type. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-03 19:19:22 +03:00
Inder Singh	90b7b34d7f	docs(self-hosted): add passkeys guide (#48954) ... ]	2026-09-03 14:15:08 +02:00
Inder Singh	479486433e	docs(self-hosted): add auth hooks guide (#43372)	2026-09-03 13:33:35 +02:00
Illia Basalaiev	37a95fd912	docs: update edge functions limits and examples across guides (#49899)	2026-09-02 20:27:02 +02:00
Katerina Skroumpelou	6e83f71a56	docs: wire middleware sdk docs (#49854) ... Wire middleware sdk docs (`@supabase/middleware`) https://github.com/supabase/middleware Preview ref here: https://docs-git-docs-supabase-middleware-sdk-supabase.vercel.app/docs/reference/middleware/introduction <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Middleware SDK reference section to the documentation. * Added installation guidance for npm, Yarn, pnpm, Deno, and Bun. * Documented framework-agnostic middleware composition, typed shared context, ordering, trust, and environment access across supported runtimes. * Added Middleware documentation to navigation and search. * Identified the Middleware SDK as an alpha release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-02 14:06:23 +03:00
Miranda Limonczenko	4d2bd0eacf	docs: add the missing API key decision information (#49799) ... Closes DOCS-1311 Closes FDBKIN-2926 Closes DOCS-694 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Corrections and new content. This is the PR that is to bring the Eval to green. ## What is the current behavior? Two statements are wrong, and the gaps behind most logged confusion about this page are unfilled. - The Availability column marks publishable and secret keys Platform-only. `supabase start` prints both. - The page says Edge Functions only verify the legacy keys and to use `--no-verify-jwt`. #49700 updated `guides/functions/auth-headers` to document that `verify_jwt` accepts the new keys on either header, but left this page and the migration guide stating the old behavior. - The page has no code samples, so it never shows how a key reaches code. An agent reading it falls back on `SUPABASE_SERVICE_ROLE_KEY`, the legacy key this same page deprecates. - Nothing maps `anon` and `service_role` to their replacements, or says the replacements aren't `eyJ`-prefixed JWTs. - The Postgres role table covers only publishable keys. ## What is the new behavior? Corrections: - Mark all four key types available on Platform and CLI, and note that the local secret key takes the place of the local `service_role` key. - Point the Edge Functions guidance at the `@supabase/server` SDK instead of `--no-verify-jwt`. Fix the same bullet in the migration guide. Additions: - "Coming from `anon` and `service_role`" gives the legacy-to-new mapping and says the replacements aren't JWTs. - Extend the Postgres role table to cover secret keys, and note that grants are evaluated before Row Level Security, so a missing grant fails even for `service_role`. - State who does what. Copying a key needs a signed-in Dashboard session, so it is a person's step, while code only refers to the variable name. Add a `.env` sample naming the variables. - Add the two `createClient` samples the page lacked, plus an "Inside an Edge Function" subsection using `withSupabase`, which reads no key from the environment. - Cross-reference from the key decision to retrieving a value, wiring it into code, or migrating an application that ships legacy keys. ## Additional context PR 4 of 4. Base is #49797. ## Manual testing 1. Open the API keys guide on the deploy preview. 2. Check the Key types table. All four rows read "Platform, CLI". 3. Check Known limitations. It no longer mentions `--no-verify-jwt`. 4. Open the migration guide and check Known limitations. The Edge Functions bullet matches. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated API key guidance with clearer instructions for finding, selecting, and using publishable and secret keys. * Added examples for environment variables, client applications, backend code, and Edge Functions. * Clarified key formats, CLI availability, local development output, Postgres role mappings, and authorization behavior. * Expanded guidance on `apikey` headers, RLS errors, and Edge Function API key authorization. * Refined migration guidance for API key authentication in Edge Functions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-01 14:40:55 -07:00
Miranda Limonczenko	5bd0b90cf0	docs: add all ways to get an API key (not just Studio) (#49797) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. ## What is the current behavior? "Find your keys" offers only the Dashboard. Readers working from a script, a preview branch, or a local stack have no path, which accounts for several logged reports of people unable to locate a key. ## What is the new behavior? Replace the procedure with a tabbed selector so a reader picks the path that matches where they work: - Dashboard, through the Connect dialog or Settings > API Keys. - Supabase CLI, `supabase projects api-keys --project-ref`, including the note that a preview branch has its own keys and needs its own ref. - Management API, `GET /v1/projects/{ref}/api-keys?reveal=true`, for deploy scripts and provisioning tooling. - Local stack, from `supabase start` output or `supabase status`. `queryGroup="retrieval-method"` makes each tab deep-linkable, so a reader can be sent straight to one path. ## Additional context PR 3 of 4. Base is #49796. ## Manual testing 1. Open the API keys guide on the deploy preview and find "Find your keys". 2. Select each tab. One panel shows at a time, and the URL gains `?retrieval-method=<tab>`. 3. Open that URL in a new tab. It restores the same selection. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the API key deprecation guidance to link to the “Find your keys” guide. - Expanded the guide with instructions for retrieving keys through the Dashboard, CLI, Management API, and local stack. - Added guidance to create keys in the Dashboard when none are available. - Reworded the table of contents entry for improved clarity. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-01 14:40:54 -07:00
Miranda Limonczenko	d7f1a44e53	docs: restructure the API keys guide by information type (#49796) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Restructure, mostly moved lines, plus a tense fix in a shared partial. ## What is the current behavior? Context, procedure, and reference material are interleaved, so background reading interrupts the action path. - The page never states which key to use as an answer. You infer it from a five-column reference table. - Finding a key is a fragment inside an admonition, placed above the page's own definition of an API key. - Rotating a leaked key, the only procedure on the page, is the last H3. - The "Changes to API keys" notice narrates a past change in future tense, and "They will be deprecated" has no antecedent in its paragraph. ## What is the new behavior? Group the guide into context, procedure, and reference sections, per CONTRIBUTING § Guides on mixed information types. - Lead with "Which key do you use?", a decision table keyed on where the code runs. Section navigation sits directly below the intro. - Collect the conceptual sections under "How API keys work" and give publishable and secret keys parallel headings. - Promote both procedures into "Find and use your keys". Rotation is now an ordered procedure. - Move the enumerated secret key rules into "Security reference", grouped under bold labels by the kind of mistake each prevents, and leave a short danger admonition where secret keys are introduced. - Promote the five-sentence coexistence admonition to its own section. Admonitions are for short warnings. - Rewrite the shared deprecation partial for timeless documentation: present tense, no dangling "They", no "now". The partial renders on five pages. - Pin a stable anchor on the rotation heading and update the one inbound link, in the rotating-anon-service-and-jwt-secrets troubleshooting entry. - Align link text across docs for this guide. Twenty-one links pointed at it under fourteen labels, including two that named the wrong destination. Rule: when a link means the guide, the text is "API keys"; when it means a specific key or section, the specific text stays. Twelve now share "API keys", up from three. Review with `git diff --color-moved=zebra`. ## Additional context PR 2 of 4. Base is #49795. Includes the link-text alignment previously opened as #49866. ## Manual testing 1. Open the API keys guide on the deploy preview. 2. Check the table of contents. It shows three groups: How API keys work, Find and use your keys, Security reference. 3. Open the rotating-anon-service-and-jwt-secrets troubleshooting entry and follow "Rotate a leaked or compromised key" under Further readings. It lands on the renamed heading. 4. Open the Realtime Broadcast guide and check the "Changes to API keys" notice. It reads in present tense there too. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated API key guidance to explain the transition from legacy `anon` and `service_role` keys to publishable and secret keys by the end of 2026. - Reorganized the API keys guide with clearer key-selection guidance, security recommendations, usage examples, and rotation steps. - Updated troubleshooting references to point to the revised leaked-key rotation guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-01 14:40:54 -07:00
Miranda Limonczenko	2f31010a18	docs: style edit for the API keys guide (#49795) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Style only. ## What is the current behavior? The API keys guide has drifted from `WORD_LIST.md` and `CONTRIBUTING.md`. It also carries two defects: - The rotation steps tell you to replace the new key with the compromised one, rather than the reverse. - The secret key caution list opens with "Do not:" but several items read "Never use" and "Do not pass", which inverts them into the opposite instruction. ## What is the new behavior? Word-level edit. No section is added, moved, or reordered, so the restructure in the next PR of this stack lands as a readable set of moved lines. - Fix the reversed rotation instruction. - Rewrite the caution list so every item completes its "Don't:" stem. - Replace the Silicon Valley character names and trailing ellipses in the responsibility table. - Drop italics used for plain emphasis, parenthetical asides, `etc.`, `&`, the lint-flagged "easy", and existential sentence openers. - Replace "since" and "as" used for cause, and future tense used for current product behavior. ## Additional context PR 1 of 4. Base is `master`. ## Manual testing 1. Open [Understanding API keys](https://docs-git-docs-api-keys-style-edit-supabase.vercel.app/docs/guides/getting-started/api-keys) on the deploy preview. 2. Read the secret key caution list. Every item completes the "Don't:" stem. 3. Read "What to do if a secret key or `service_role` has been leaked or compromised". The order is: create the new key, then replace the compromised key with it. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Rewritten the API keys guide with clearer wording and improved structure. * Clarified how to access API keys through the Connect dialog and distinguished API keys from Supabase Auth. * Updated explanations of publishable and secret keys, including cautions, security best practices, and steps for responding to leaked keys. * Refined guidance on known limitations and compatibility differences. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-09-01 14:40:53 -07:00
Anthony Lio	55385adad5	fix(docs): fix tab bar overlapping code blocks (#49775) ... ## What kind of change does this PR introduce? bug fix: removes `<$CodeTabs>` from [declarative-database-schemas.mdx](https://github.com/supabase/supabase/blob/master/apps/docs/content/guides/local-development/declarative-database-schemas.mdx) following up with #49263 ## What is the current behavior? on [/declarative-database-schemas](https://supabase.com/docs/guides/local-development/declarative-database-schemas#declaring-your-schema) the tab bar above each step code block overlaps the code below it every step wraps code in `<$CodeTabs>` but carries a `-mb-6` expecting the code default margin to absorb it, while `StepHikeCompact` zeroes™ it note: it's the only page nesting `<$CodeTabs>` inside a step ## What is the new behavior? | state | preview | | -------|------| | before | <img width="795" height="417" alt="image" src="https://github.com/user-attachments/assets/d3d65f57-d621-4d5a-a3f9-229f5908cdf7" /> | | after | <img width="795" height="417" alt="image" src="https://github.com/user-attachments/assets/f3dc9f2d-fd4b-4ebd-95b4-63de587604fb" /> | ## Additional context could go the other way and add `<$CodeTabs>` to those two guides for consistency but that would need StepHikeCompact to take another ! utility to restore it, but not against it if feels better.	2026-09-01 17:15:55 +03:00
Wen Bo Xie	2681a21f5c	docs: add Personal Access Tokens guide with generated permission tables (#49732) ... Add a guide that compares classic and scoped personal access tokens, explains how account roles constrain token permissions, and walks through creating and testing a project-scoped token. Include generated tables mapping permissions to Management API endpoints and MCP tools, and link the guide from docs navigation and Studio token sheets. Move the scoped-token permission catalog from Studio into shared-data. Studio and docs generation now share permission names, categories, descriptions, risk metadata, modes, scopes, and display order. Generate the tables from the shared catalog, OpenAPI x-fga-permissions, and the downloaded MCP permission map. Exclude Workers permissions until the feature is live. Run regeneration through the docs Makefile, verify checked-in output in CI, and refresh it in the weekly Management API workflow. Add Dashboard and Docs ownership plus contributor guidance so permission changes stay synchronized.	2026-09-01 12:30:56 +00:00