Connect Supabase

Link your Supabase project to query user data, signups, custom tables, and any Postgres data directly from Slack. Supabase is a first-class source in alice, supporting the Visual Builder, Raw SQL, and combined cross-source queries.

Prerequisites

Before connecting Supabase, make sure you have:

• A Supabase project with at least one table containing data you want to query. alice reads your database schema to power the Visual Builder and AI generation.
• Project access in Supabase. You need to be an owner or admin of the Supabase organization that contains the project.
• An alice workspace already set up. If you have not created one yet, follow the Quickstart guide first.
• The alice Slack bot installed in your workspace. See Slack Installation if you have not done this yet.

How to Connect

Connecting Supabase uses Supabase's OAuth flow followed by a project picker. The whole process takes about a minute.

1. Navigate to Dashboard > Sources from the sidebar.
2. Click the Add Source button in the top right corner.
3. Select Supabase from the source type list.
4. You will be redirected to Supabase's OAuth authorization screen. Review the permissions alice requests.
5. Click Authorize to grant access.
6. After authorization, alice shows the project picker -- a searchable list of all Supabase projects in your account.
7. Select the project you want to connect.
8. alice validates the connection and redirects you back to the Sources page with Supabase listed as connected.

The Project Picker

After OAuth authorization, alice fetches all Supabase projects accessible to your account and presents them in a searchable dropdown. Each entry shows:

• Project name (e.g., "my-saas-app")
• Region (e.g., "us-east-1", "eu-west-2")
• Organization the project belongs to

If you have multiple Supabase projects, use the search field to filter by name. Select the project that contains the data you want alice to query.

You can connect multiple Supabase projects on Pro and Business plans (up to 3 sources on Pro, unlimited on Business). Each project is treated as a separate source.

What Data You Get

Once Supabase is connected, alice can query any table in your Postgres database. Unlike Stripe (which has fixed metric blocks), Supabase skills are fully flexible -- you write SQL or use the Visual Builder to query whatever data your application stores.

Common Query Patterns

Visual Builder Support

For Supabase sources, the skill builder offers a Visual Builder mode that lets you construct queries without writing SQL. You can:

• Select a table from a dropdown of all tables in your database
• Choose columns to include in the result
• Add filter conditions using operators: equals, not_equals, gt, gte, lt, lte, like, in, is_null, is_not_null
• Set sort order (ascending or descending by any column)
• Set a row limit

The Visual Builder generates SQL under the hood, so you can switch to Raw SQL mode at any time to see and edit the generated query. See Create a Skill for the full walkthrough.

Raw SQL

For complex queries (joins, aggregations, subqueries, CTEs), use Raw SQL mode. Write standard PostgreSQL with $1, $2, etc. as parameter placeholders. See Query Syntax Reference for supported syntax and examples.

Security

Supabase connections in alice are designed with defense-in-depth security:

Read-Only Queries

All queries executed through alice are read-only. The query executor enforces this at the application level -- INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE, and other write operations are rejected before they reach your database. This is hard-coded and cannot be overridden by users.

Row Level Security (RLS)

If your Supabase project uses Row Level Security, those policies are respected. alice does not use the service_role key to bypass RLS. This means:

• Tables with RLS enabled will return only rows that the connected role has access to.
• If a table has no RLS policies, all rows are accessible (consistent with Supabase's own behavior).
• If you need alice to access specific rows, ensure your RLS policies allow the connected role to select them.

AES-256 Encryption at Rest

When you connect Supabase, the OAuth credentials are encrypted using AES-256 before being stored in alice's database. The encryption key is stored separately as an environment variable and is never committed to source code. Credentials are decrypted only at the moment of query execution and are never written to application logs.

Credential Isolation

Each workspace's Supabase credentials are isolated by organization. alice's own Row Level Security policies ensure that one workspace cannot access another workspace's source credentials. The credential retrieval function verifies source.org_id === requesting_org_id before returning any credentials.

Disconnect Anytime

You can revoke alice's access at any time:

1. From alice: Dashboard > Sources > Supabase > Disconnect
2. From Supabase: Revoke the OAuth token in your Supabase organization settings

For more details on alice's security architecture, see Security.

Troubleshooting

Project Not Appearing in Picker

If your project does not show up in the project picker after OAuth authorization:

• Check the account. Make sure you authorized the correct Supabase account. If you have multiple Supabase accounts (personal and work), you may have authorized the wrong one.
• Check project permissions. You need at least read access to the project in Supabase. Contact your Supabase organization admin if you do not see the expected project.
• Try re-authorizing. Disconnect from Dashboard > Sources and go through the OAuth flow again, making sure to select the correct Supabase account.

Query Returns Empty Results

Empty results usually have one of these causes:

• No matching data. The query conditions are too restrictive. Try broadening filters or removing the WHERE clause to see if the table has data at all.
• RLS policies blocking access. If the table has Row Level Security enabled, the connected role may not have a policy that grants SELECT access. Check your RLS policies in the Supabase Dashboard.
• Wrong table name. Table names are case-sensitive in Postgres. Make sure the table name in your query matches exactly.

"Permission Denied" Errors

This error typically means the connected database role does not have SELECT privileges on the table you are querying:

1. Check the table's permissions in Supabase: Table Editor > your table > RLS Policies.
2. Ensure the anon or authenticated role (whichever alice uses) has a SELECT policy.
3. If the table is in a custom schema (not public), make sure the role has USAGE on that schema.

Connection Shows "Error" or "Disconnected"

If the Supabase connection status shows an error:

1. The OAuth token may have expired or been revoked. Click Reconnect to re-authorize.
2. If the Supabase project was deleted or paused, alice cannot reach it. Resume or recreate the project, then reconnect.
3. Check the Supabase status page for any ongoing incidents.

Query Times Out

Supabase queries have a timeout to prevent long-running queries from blocking resources:

• Simplify the query. Add LIMIT, reduce joins, or add indexes to the columns used in WHERE and ORDER BY clauses.
• Use the Visual Builder. It automatically adds a LIMIT and generates optimized queries.
• Check for missing indexes. Queries filtering on unindexed columns in large tables can be slow. Add indexes in your Supabase Dashboard.

Next Steps

• Connect Stripe -- Add revenue data as a second source
• Create a Skill -- Build a Supabase skill using the Visual Builder or Raw SQL
• Combined Queries -- Join Supabase user data with Stripe revenue data in a single skill
• Parameters -- Add dynamic inputs so users can pass filters when running skills
• Query Syntax Reference -- SQL syntax patterns and examples
• Plans and Pricing -- Source limits by plan tier