Supabase CLI config
A supabase/config.toml file is generated after running supabase init.
You can edit this file to change the settings for your locally running project. After you make changes, you will need to restart using supabase stop and then supabase start for the changes to take effect.
General Config
project_id
| Name | Default | Required |
|---|---|---|
| project_id | None | true |
Description
A string used to distinguish different Supabase projects on the same host. Defaults to the working directory name when running supabase init.
Local projects started with the experimental supabase stack commands are identified by their project directory, git branch, and --stack name instead. See Running multiple local projects.
Auth Config
auth.email.notification.<type>.enabled
| Name | Default | Required |
|---|---|---|
| auth.email.notification.type.enabled | None | false |
Description
Determines whether or not to send email notifications for the given type.
The full list of email notification types are:
password_changedemail_changedphone_changedmfa_factor_enrolledmfa_factor_unenrolledidentity_linkedidentity_unlinked
See also
auth.email.notification.<type>.subject
| Name | Default | Required |
|---|---|---|
| auth.email.notification.type.subject | None | false |
Description
The subject for the given email notification type.
The full list of email notification types are:
password_changedemail_changedphone_changedmfa_factor_enrolledmfa_factor_unenrolledidentity_linkedidentity_unlinked
See also
auth.email.notification.<type>.content_path
| Name | Default | Required |
|---|---|---|
| auth.email.notification.type.content_path | None | false |
Description
The relative path to the content template for the given email notification type.
The full list of email notification types are:
password_changedemail_changedphone_changedmfa_factor_enrolledmfa_factor_unenrolledidentity_linkedidentity_unlinked
See also
auth.external.<provider>.enabled
| Name | Default | Required |
|---|---|---|
| auth.external.provider.enabled | false | false |
Description
Use an external OAuth provider. The full list of providers are:
appleazurebitbucketdiscordfacebookgithubgitlabgooglekakaokeycloaklinkedin_oidcnotiontwitchtwitterslack_oidcspotifyworkoszoom
See also
auth.external.<provider>.url
| Name | Default | Required |
|---|---|---|
| auth.external.provider.url | None | false |
Description
The base URL used for constructing the URLs to request authorization and access tokens. Used by gitlab and keycloak. For gitlab it defaults to https://gitlab.com. For keycloak you need to set this to your instance, for example: https://keycloak.example.com/realms/myrealm .
See also
auth.external.<provider>.skip_nonce_check
| Name | Default | Required |
|---|---|---|
| auth.external.provider.skip_nonce_check | None | false |
Description
Disables nonce validation during OIDC authentication flow for the specified provider. Enable only when client libraries cannot properly handle nonce verification. Be aware that this reduces security by allowing potential replay attacks with stolen ID tokens.
See also
auth.hook.<hook_name>.uri
| Name | Default | Required |
|---|---|---|
| auth.hook.<hook_name>.uri | None | false |
Description
URI of hook to invoke. Should be a http or https function or Postgres function taking the form: pg-functions://<database>/<schema>/<function-name>. For example, pg-functions://postgres/auth/custom-access-token-hook.
See also
API Config
Database Config
db.migrations.schema_paths
| Name | Default | Required |
|---|---|---|
| db.migrations.schema_paths | [] | false |
Description
An ordered list of schema files, directories, or glob patterns describing your database, relative to the supabase directory. For example: ["./schemas/*.sql"].
Only the legacy migra diff engine uses this setting, where it controls the order in which declarative schema files are applied. On that engine, supabase db pull --declarative sets it to the declarative schema directory automatically. The pg-delta diff engine (see experimental.pgdelta.enabled) ignores it and orders declarative files by the dependencies between statements. It warns when the setting lists any paths.
See also
Dashboard Config
Storage Config
Edge-Functions Config
functions.<function_name>.enabled
| Name | Default | Required |
|---|---|---|
| functions.function_name.enabled | true | false |
Description
Controls whether a function is deployed or served. When set to false, the function will be skipped during deployment and won't be served locally. This is useful for disabling demo functions or temporarily disabling a function without removing its code.
functions.<function_name>.verify_jwt
| Name | Default | Required |
|---|---|---|
| functions.function_name.verify_jwt | true | false |
Description
By default, when you deploy your Edge Functions or serve them locally, it will reject requests without a valid JWT in the Authorization header. Setting this configuration changes the default behavior.
Note that the --no-verify-jwt flag overrides this configuration.
functions.<function_name>.import_map
| Name | Default | Required |
|---|---|---|
| functions.function_name.import_map | None | false |
Description
Specify the Deno import map file to use for the Function.
When not specified, defaults to supabase/functions/<function_name>/deno.json.
Note that the --import-map flag overrides this configuration.
functions.<function_name>.entrypoint
| Name | Default | Required |
|---|---|---|
| functions.function_name.entrypoint | None | false |
Description
Specify a custom entrypoint path for the function relative to the project root.
When not specified, defaults to supabase/functions/<function_name>/index.ts.
Usage
1[functions.my_function]
2entrypoint = "path/to/custom/function.ts"functions.<function_name>.static_files
| Name | Default | Required |
|---|---|---|
| functions.function_name.static_files | None | false |
Description
Specify an array of static files to be bundled with the function. Supports glob patterns.
NOTE: only file paths within functions directory are supported at the moment.
Usage
1[functions.my_function]
2static_files = [ "./functions/MY_FUNCTION_NAME/*.html", "./functions/MY_FUNCTION_NAME/custom.wasm" ]Analytics Config
Experimental Config
experimental.stack
| Name | Default | Required |
|---|---|---|
| experimental.stack | false | false |
Description
Turns on the experimental supabase stack commands, and makes the top-level supabase start, supabase status, and supabase stop commands run supabase stack start, supabase stack status, and supabase stack stop. The local targets of the db, migration, test, gen, inspect, pull, storage, seed, and services commands, and functions serve, also use the stack. With this setting, several local projects can run at the same time on one machine. On supported platforms a local project can also run without Docker.
Local projects started this way keep their own data, separate from local projects started with the default supabase start. The environment variable SUPABASE_EXPERIMENTAL_STACK=1 or 0 overrides this value.
Note: This is an experimental feature and may change in future releases.
See also
experimental.s3_access_key
| Name | Default | Required |
|---|---|---|
| experimental.s3_access_key | env(S3_ACCESS_KEY) | false |
Description
Configures AWS_ACCESS_KEY_ID for S3 bucket access. DO NOT commit your AWS access key to git. Use environment variable substitution instead. Note: This is an experimental feature and may change in future releases.
See also
experimental.s3_secret_key
| Name | Default | Required |
|---|---|---|
| experimental.s3_secret_key | env(S3_SECRET_KEY) | false |
Description
Configures AWS_SECRET_ACCESS_KEY for S3 bucket access. DO NOT commit your AWS secret key to git. Use environment variable substitution instead. Note: This is an experimental feature and may change in future releases.
See also
experimental.pgdelta.enabled
| Name | Default | Required |
|---|---|---|
| experimental.pgdelta.enabled | false | false |
Description
Enables the pg-delta diff engine for db diff, db pull, and the db schema declarative commands.
Projects created with a recent supabase init have this set to true in the generated config.toml. Existing projects keep the legacy migra engine until they opt in by adding this setting. Set to false to fall back to migra.
Note: This is an experimental feature and may change in future releases.
See also
experimental.pgdelta.declarative_schema_path
| Name | Default | Required |
|---|---|---|
| experimental.pgdelta.declarative_schema_path | ./schemas | false |
Description
The directory where the pg-delta engine reads and writes declarative schema files. Relative paths resolve from the supabase directory.
CLI versions before 2.115.0 defaulted to ./database. If that directory still holds schema files, ./schemas is empty, and this setting is unset, the CLI warns and reads ./schemas instead. To keep that tree, set ./database here.
Note: This is an experimental feature and may change in future releases.
See also
experimental.pgdelta.format_options
| Name | Default | Required |
|---|---|---|
| experimental.pgdelta.format_options | None | false |
Description
A JSON string of formatting options applied to SQL generated by the pg-delta engine. When unset, generated SQL uses uppercase keywords wrapped at a maximum line width of 180 characters.
Supported keys: keywordCase ("upper", "lower", or "preserve"), commaStyle ("trailing" or "leading"), indent (number), maxWidth (number), and the booleans alignColumns, alignKeyValues, preserveRoutineBodies, preserveViewBodies, and preserveRuleBodies. Omitted keys keep their defaults.
For example: format_options = "{\"keywordCase\":\"lower\",\"maxWidth\":80}". Set format_options = "null" to emit raw statements with no formatting applied.
Note: This is an experimental feature and may change in future releases.
See also
Local Development Config
local_smtp.enabled
| Name | Default | Required |
|---|---|---|
| local_smtp.enabled | true | false |
Description
Enable the local SMTP testing server.
Supabase CLI versions before v2.108.0 use [inbucket] instead of [local_smtp]. Newer versions still accept [inbucket] but print a deprecation warning, so rename the section after you upgrade.
See also
local_smtp.port
| Name | Default | Required |
|---|---|---|
| local_smtp.port | 54324 | false |
Description
Port to use for the email testing server web interface.
Emails sent with the local dev setup are not actually sent - rather, they are monitored, and you can view the emails that would have been sent from the web interface.
See also
local_smtp.smtp_port
| Name | Default | Required |
|---|---|---|
| local_smtp.smtp_port | 54325 | false |
Description
Port to use for the email testing server SMTP port.
Emails sent with the local dev setup are not actually sent - rather, they are monitored, and you can view the emails that would have been sent from the web interface.
If set, you can access the SMTP server from this port.
See also
local_smtp.pop3_port
| Name | Default | Required |
|---|---|---|
| local_smtp.pop3_port | 54326 | false |
Description
Port to use for the email testing server POP3 port.
Emails sent with the local dev setup are not actually sent - rather, they are monitored, and you can view the emails that would have been sent from the web interface.
If set, you can access the POP3 server from this port.
See also
Branching Config
remotes.<branch_name>.project_id
| Name | Default | Required |
|---|---|---|
| remotes.branch_name.project_id | None | true |
Description
The project reference ID for a specific persistent Supabase branch. This ID is used to configure branch-specific settings in your config.toml file for branches deployments. All other configuration options available in the root config are also supported in the remotes block. For example, you can specify branch-specific database settings like so:
Usage
1[remotes.<branch_name>]
2project_id = "your-project-ref"
3
4[remotes.<branch_name>.db.seed]
5sql_paths = ["./seeds/staging.sql"]