Your agency has asked for access to Supabase. You don't need to share your password for it. Supabase lets you add them with their own login, choose exactly what they can do, and remove them when the project ends. These are the clicks, checked against Supabase's own help pages in October 2026.
Which role to choose
Pick the narrowest role that lets your agency do the work. Developer is usually the right one.
| Role | What it allows | For an agency |
|---|---|---|
| Developer | Works on data, storage, edge functions and auth users in every project. Cannot change project settings, secrets, billing or members. | Usually the right one |
| Administrator | Full access to every project, including settings and members. Cannot change organization settings or add owners. | If the work needs it |
| Read-only | Sees the organization and its projects without changing anything. Team and Enterprise plans only. | If the work needs it |
Add your agency to Supabase
- In the Supabase dashboard, open your organization and go to its team settings.
- Invite your agency's email address and choose the Developer role.
Only an Owner or Administrator can invite members, and the invite is valid for 24 hours. Every plan allows unlimited members. If your organization was created through Vercel, roles are managed in Vercel instead, so add your agency to your Vercel team.
How you both know it worked
Supabase emails your agency an invitation from supabase.com. Once they accept it, they show in your Supabase account's list of people with access, where you can see or change their role at any time.
Remove access when the project ends
- Open the team settings of your organization in the Supabase dashboard.
- Remove your agency's email address from the members.
- Rotate any API keys and secrets your agency could see, such as the service key.
Do you have to share your password?
No. Every step above uses Supabase's own invite, so your agency signs in with their own account, your two-step verification stays on, and anything they change is recorded under their name. How to give a developer access without sharing your password covers the other accounts agencies usually ask for.
Doing this for every client?
Agencies can send each client one Get Set Keys link instead of a page like this. It walks the client through Supabase and the other platforms the project needs, and checks that each step is done.