By Supabase’s September 2026 developer update ships two features teams have been requesting for years and one breaking change that hits September 23. If you’re running automation scripts, AI agents, or anything calling the Supabase Management API, read the last section first.
Scoped Personal Access Tokens: A Leaked Token Is No Longer a Full Breach
Classic Supabase PATs carry your account’s full access — every organization, every project you belong to today and every one you join in the future. That’s a problem when you’re handing a token to a CI pipeline, an AI agent, or a script that only needs to read one project’s database.
Scoped tokens fix this. You choose the organizations, projects, and permissions the token can touch. A scope like “read project X, view its logs, nothing else” is now possible. A leaked scoped token caps the damage at exactly what you granted. A leaked classic token still means a full account takeover.
Scoped tokens are in public alpha and rolling out gradually. The recommended practice going forward: every automated system — CI, agents, external integrations — should use scoped tokens. Classic tokens belong in your hand and nowhere else. The official PAT documentation covers how to configure scopes.
W3C Trace Context: Your Client Traces Finally Reach Supabase Logs
Debugging a production issue when you can’t tell if the fault is in the client or deep in a Supabase Edge Function is a special kind of frustrating. The September update closes that gap.
supabase-js, Swift, Flutter, and Python SDKs now propagate W3C Trace Context headers — traceparent, tracestate, baggage — to Supabase. The trace_id you capture client-side with Sentry or OpenTelemetry now shows up in API Gateway and Edge Function logs. One ID, one thread through the entire request path.
It’s opt-in and compatible with any W3C-compliant tracer: OpenTelemetry, Sentry, Datadog, Honeycomb, Grafana. Setup is two steps: install @opentelemetry/api and import @supabase/supabase-js/tracing at your application entry point. The official trace context announcement has the full implementation guide.
Pipelines Expands: ClickHouse, Snowflake, DuckLake Join BigQuery
Running analytics queries on your production Postgres is a trap. Pipelines is Supabase’s managed CDC layer that routes table changes to a dedicated analytics destination in near real time, so the heavy queries run somewhere else.
This month, ClickHouse, Snowflake, and DuckLake join BigQuery as destinations, available through early access. The underlying engine is open-source Rust, and schema change detection is now automatic — add a column in Postgres and Pipelines propagates it to the destination without manual intervention.
ClickHouse users get two table strategies: current-state ReplacingMergeTree or append-only MergeTree CDC history. The cost is $0.053 per hour per active pipeline — roughly $38 per month at constant use — plus $0.60/GB for the initial table copy and $3/GB for ongoing replication. Destination provider charges are separate. The Pipelines public alpha post has the full destination matrix and setup guide.
Postgres Changes: AND Filters, New Operators, Column Selection
Realtime subscriptions now support compound AND filters and new operators: like and ilike for pattern matching, is for null and boolean checks, match/imatch for POSIX regex, and isdistinct for NULL-safe inequality. Prefix any operator with not. to invert.
More useful for most teams: you can now specify which columns come back in the payload. Set a select option and only those fields arrive — the primary key always comes through regardless. For high-volume subscriptions, this directly reduces message and egress costs.
Act Before September 23: The logs.all Endpoint Is Gone
The Supabase Management API’s logs.all analytics endpoint is removed on September 23, 2026. If you call analytics/endpoints/logs.all in any script, integration, or tooling, update it to analytics/endpoints/logs now. The new endpoint uses ClickHouse SQL and consolidates all log sources into a single unified table instead of separate per-source tables.
If you’re running AI agents through the Supabase MCP server, the get_logs tool called logs.all internally. Update mcp-server-supabase to v0.10.0 — it’s already available. The migration notice has the full details. The dashboard Logs Explorer is not affected.
Edge Function limits also got a quiet bump this month: Pro plans move from 500 to 1,000 functions; Team plans from 1,000 to 2,000. This is function count, not execution time or invocations.
