Supabase MCP in VS Code: OAuth login never starts when project_ref or read_only is in the URL

Question

After adding the Supabase MCP server to VS Code, either via the 'Add to VSCode' button or a manual config entry, the server starts but the browser login for authentication never appears. The reporter was on Windows 11 with Node.js 22.14.0 and supabase-js 2.56.0. How can authentication be triggered?

Originally asked on GitHub: https://github.com/supabase/mcp/issues/157

AgentArmorHQ team · Accepted Answer

Status: the maintainer said a fix for OAuth with query strings in the MCP URL was submitted internally and expected to ship in a later release; the issue was then closed as completed. The thread does not state the exact release version.

The cause, per the maintainer, is that any query string in the MCP URL, such as `project_ref` or `read_only=true`, causes a mismatch in the resource URL, so the OAuth flow does not start.

Workaround 1: use the plain base URL. A commenter confirmed that this triggers the browser authentication:

```json
"supabase": {
  "url": "https://mcp.supabase.com/mcp",
  "type": "http"
}
```

Workaround 2, suggested by a maintainer as an option without OAuth: create a personal access token in the Supabase dashboard and send it as a header:

```json
"supabase": {
  "url": "https://mcp.supabase.com/mcp",
  "type": "http",
  "headers": {
    "Authorization": "Bearer <access-token>"
  }
}
```

Another user on Windows 11 with Kilocode 4.100.0 reported `Error POSTing to endpoint (HTTP 401): {"message":"Unauthorized"}` with the base URL and asked whether the type should be `http` or `streamable-http`; the thread does not record a fix for that case.

The maintainer also noted that the previous stdio distribution is still available.

AgentArmorHQ team · Answer

**What a GitHub user tried on GitHub** (Didn't work)

Reporter added the Supabase MCP through the 'Add to VSCode' button and also with a manual config entry. The server started but the browser OAuth login never opened.

Source: https://github.com/supabase/mcp/issues/157

AgentArmorHQ team · Answer

**What @byP4ndaDev tried on GitHub** (Worked)

Changed the config to the base URL `https://mcp.supabase.com/mcp` with `"type": "http"`. This triggered the browser authentication.

Source: https://github.com/supabase/mcp/issues/157#issuecomment-3382393806

AgentArmorHQ team · Answer

**What @mario-neuhold tried on GitHub** (Didn't work)

Added `read_only=true` as a query parameter to the URL. It produced the same authentication failure as the `project_ref` parameter.

Source: https://github.com/supabase/mcp/issues/157#issuecomment-3383324705

AgentArmorHQ team · Answer

**What @kompazz tried on GitHub** (Didn't work)

A user on Windows 11 with VS Code and Kilocode 4.100.0 used the base URL and got `Error POSTing to endpoint (HTTP 401): {"message":"Unauthorized"}`. They asked whether the type should be `http` or `streamable-http`.

Source: https://github.com/supabase/mcp/issues/157#issuecomment-3383451491

AgentArmorHQ team · Answer

**What @mattrossman tried on GitHub** (Outcome unclear)

A maintainer suggested a Supabase personal access token sent as an `Authorization: Bearer <access-token>` header in the MCP config, as an option that avoids OAuth until the fix is released.

Source: https://github.com/supabase/mcp/issues/157#issuecomment-3390122538

Supabase MCP in VS Code: OAuth login never starts when project_ref or read_only is in the URL

6 answers

Add your answer or comment