supabase "not logged in" (SUPABASE_ACCESS_TOKEN) in CI

By Daniel Zoghalchali·Latchkey

The Supabase CLI logs in through a browser by default, which is impossible in CI. For automation it reads SUPABASE_ACCESS_TOKEN, a personal access token from your account. Without it, project-linked commands report that you need to log in.

What this error means

A "supabase link" or "supabase db push" step fails with "You need to be logged in. Run supabase login" or "Access token not provided" in the workflow.

Access token not provided. Supply an access token by running supabase login
or setting the SUPABASE_ACCESS_TOKEN environment variable.

Common causes

No access token in the environment

The CLI cannot complete the browser login headlessly and SUPABASE_ACCESS_TOKEN is unset, so it has no credential.

The token is scoped to the wrong step

A token set only on one step is not visible to the command that needs it, so it still reports no login.

How to fix it

Set SUPABASE_ACCESS_TOKEN as a secret

1. Create a personal access token in the Supabase dashboard.
2. Store it as a CI secret.
3. Expose it to every supabase command in the job.

env:
  SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
run: supabase projects list

Use the setup-cli action then authenticate

Install the pinned CLI, then run commands with the token in the environment.

- uses: supabase/setup-cli@v1
  with:
    version: latest
- run: supabase projects list
  env:
    SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}

How to prevent it

• Use a personal access token for CI, never the interactive login.
• Set SUPABASE_ACCESS_TOKEN at the job level so all steps inherit it.
• Rotate the token and update the secret in one place.

Frequently asked questions

Related guides

References

• GitHub Actions documentation