Connecting Supabase to OwlAI, the easy way

#Approve in Supabase and pick a project instead of copying addresses

Your product data lives in Supabase. To connect it to an AI, someone opens the Supabase dashboard and finds three addresses for the same database. They copy one and try to register it. One address can't be reached from the AI server's network; one port doesn't fit the way the AI sends SQL. Even with the right address, the username needs the project marker appended, and the certificate that verifies the server has to be tracked down and added separately. When registration fails, it's hard to tell which of these went wrong.

In SaaS, nobody copies addresses. You approve OwlAI in Supabase and pick a project, and the registration form fills in the right address and port, the encryption setting, and the certificate. Your admin enters only the account and password the AI will use.

#Approve, pick a project, and the form fills in

When your admin clicks Connect with Supabase, a new tab opens Supabase's approval page. Someone signs in to Supabase and approves OwlAI, and the original tab shows that account's projects. Pick one and the form fills in the address of the connection pooler (the relay server Supabase puts in front of each project) along with the port that works for OwlAI. Encryption in transit (TLS) is set to required, and the root certificate that verifies Supabase's server certificate is already built into OwlAI. “Supabase connection addresses are filled by OAuth approval, not copied by hand” explains which of the three addresses OwlAI uses and why.

At registration, OwlAI asks Supabase for the project's address once more and refuses to register if the submitted address differs. A connection imported from Supabase only ever points at the server Supabase reported.

#A person enters the account and password

In the account field, enter only the name of the read-only role you created for the AI. OwlAI appends the project marker. Supabase does not reveal the password, so someone on your team types it. That means you decide from the start which database account the AI uses and what it can read. The default account Supabase shows is not filled in for you.

#Register other projects within the hour

The approval lasts an hour. After registering the first project, Register another project lets you pick another project from the same account without approving again. When you're done, click Finish.

OwlAI uses the access from the Supabase approval only to fill in the form, and discards it after an hour. It never renews that access, so nothing lingers. To clean up the approved app, revoke it from the list of authorized apps in your Supabase account.

If the address changes later, Import again has you approve once more and pick the same project. The new address fills into the same connection, and the analysis and permission settings you've built up stay as they were.

#What to settle before you connect Supabase

Decide these before connecting a Supabase project:

• who approves OwlAI in Supabase (an account that can see the projects to connect)
• the read-only role the AI will use (with access only to the tables it should read), and who enters its password
• whether to resume a paused project in Supabase first
• whether to remove the approved app from your Supabase account after registration