临时访问

你的 Supabase 项目支持使用 Supabase API 令牌（个人访问令牌）或当前仪表板会话令牌（JWT）连接到 Postgres 数据库。这被称为临时访问，因为认证令牌可能是短期的，并且直接关联到特定的 Supabase 用户。临时访问默认是关闭的。

🌐 Your Supabase project supports connecting to the Postgres database using either your Supabase API token (Personal Access Token) or your current dashboard session token (JWT). This is called temporary access, as the authentication tokens can be short-lived and tied directly to a specific Supabase user. Temporary access is disabled by default.

启用临时访问只适用于连接 Postgres 和 Supavisor（“连接池”）；Supabase 提供的所有 HTTP API（例如 PostgREST、Storage、Auth）都需要针对特定服务的身份验证令牌，并且独立于 Supabase 平台用户。

🌐 Enabling temporary access only applies to connections to Postgres and Supavisor ("Connection Pooler"); all HTTP APIs offered by Supabase (e.g., PostgREST, Storage, Auth) require authentication tokens specific to the service and are independent of the Supabase platform user(s).

通过仪表板管理临时访问 #

🌐 Manage temporary access via the dashboard

管理临时访问的最简单方法是通过仪表板中 数据库设置页面 的“启用临时访问”设置部分。

🌐 The easiest way to manage temporary access is via the "Enable temporary access" settings section in Database Settings page of the dashboard.

通过管理 API 管理临时访问 #

🌐 Manage temporary access via the Management API

你也可以用管理 API 来管理临时访问：

🌐 You can also manage temporary access using the Management API:

1
# Get your access token from https://supabase.com/dashboard/account/tokens
2
export SUPABASE_MANAGEMENT_API_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Get current temporary access status
6
curl -X GET "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit-access" \
7
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN"
8
9
# Enable temporary access
10
curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit-access" \
11
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
12
  -H "Content-Type: application/json" \
13
  -d '{
14
    "state":"enabled"
15
  }'
16
17
# Disable temporary access
18
curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit-access" \
19
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
20
  -H "Content-Type: application/json" \
21
  -d '{
22
    "state":"disabled"
23
  }'

配置用户访问 #

🌐 Configure user access

一旦临时访问被启用，项目用户必须被授权并映射到他们允许访问的 Postgres 角色。每个用户可以使用临时访问被授权“承担”一个或多个 Postgres 角色。

🌐 Once temporary access has been enabled, project users must be authorized and mapped to Postgres roles they are allowed to access. Each user can be authorized to "assume" one or more Postgres roles using temporary access.

当用户被授权获取一个 Postgres 角色时，用户的访问令牌（个人访问令牌 (PAT) 或限定 PAT）将被用作该 Postgres 角色的密码。

🌐 When a user is authorized to assume a Postgres role, the user's access token (Personal Access Token (PAT) or Scoped PAT) will be used as the password for the Postgres role.

应用临时访问限制 #

🌐 Apply temporary access restrictions

用户的临时访问也可以被限制在一个有效期内，过了这个期限，他们的临时访问就会失效，即使访问令牌仍然有效，数据库也会拒绝连接。

🌐 A user's temporary access can also be restricted to a validity period, after which their temporary access will expire and even though the access token is still valid, the database will reject the connection.

也可以应用 IP 地址限制，确保临时访问只会被允许来自允许的网络范围（IPv4 和/或 IPv6）。

🌐 IP address restrictions can also be applied, ensuring that temporary access will only be authorized from allowed network ranges (IPv4 and/or IPv6).

使用管理 API 应用限制 #

🌐 Applying restrictions with the management API

也可以通过管理 API 应用限制。

🌐 Restrictions can also be applied through the Management API.

1
# Get your access token from https://supabase.com/dashboard/account/tokens
2
export SUPABASE_MANAGEMENT_API_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Restrict temporary access to IPv4 ranges and expiry date
6
# user_id is the gotrue_id of the user with access to the project
7
curl -X PUT "https://api.supabase.com/v1/projects/$PROJECT_REF/database/jit" \
8
  -H "Authorization: Bearer $SUPABASE_MANAGEMENT_API_TOKEN" \
9
  -H "Content-Type: application/json" \
10
  -d '{
11
    "user_id": "00000000-1111-2222-3333-444444444444",
12
    "user_roles": [
13
      {
14
        "role": "postgres",
15
        "allowed_networks": {
16
          "allowed_cidrs": [{ "cidr": "176.1.12.1/32" }]
17
        },
18
        "expires_at": 1758721065775
19
      }
20
    ]
21
  }'

使用临时访问 #

🌐 Using temporary access

要使用临时访问登录数据库，可以使用现有的连接字符串，只需将密码更改为用户的 API 或仪表板令牌即可。

🌐 To log in to the database using temporary access, existing connection strings can be used and only the password needs to be changed to the user's API or dashboard token.

例如，如果一个用户被授权来承担 postgres 角色：

🌐 For example, if a user has been authorized to assume the postgres role:

1
psql 'postgres://postgres:sbp_111222333aaabbbccc@db.{project-ref}.supabase.co/postgres'

由于可以使用 Supabase API 令牌，因此也可以为你不想共享 Postgres 角色密码的服务生成 API 令牌（例如 GitHub Action）。API 令牌可以配置过期时间，还可以应用临时的访问特定限制。

🌐 Since Supabase API tokens can be used, it is also possible to generate API tokens for services you don't want to share your Postgres role password with (for example a GitHub Action). The API token can be configured with an expiry time and temporary access-specific restrictions can also be applied.

通过共享连接池器进行连接需要添加一个新的连接选项。这个可以直接在连接 URI 中应用，也可以作为 conninfo（更易读）：

🌐 Connecting via the shared connection pooler requires the addition of a new connection option. This can be applied either directly in the connection URI or as conninfo (easier to read):

1
# directly in the URI
2
psql 'postgres://postgres.{project-ref}:sbp_111222333aaabbbccc@aws-1-us-west-1.pooler.supabase.com:5432/postgres?options=-c%20jit%3dtrue'
3
4
# or as a connection info string
5
psql "host=aws-1-us-west-1.pooler.supabase.com user=postgres.{project-ref} options='-c jit=true'"