Vendo Docs

Supabase is wired into Vendo via the Composio bridge. Tool authors connect a tenant's Supabase account through Vendo's UI; once connected, the SDK exposes the credential at runtime so your tool can call the Supabase API on the tenant's behalf.

Auth modes

Profile	Default	How it works
`composio_managed` (Composio-managed)	Yes	Connection brokered through Composio. Tenant connects via the embedded Composio OAuth flow; Vendo issues a Composio session at request time.

Environment variables

These are the env vars Vendo injects into your deployment at boot when this integration is bound. Source values are resolved by resolveConnectionEnvVars in packages/integrations/lib/ from the connection record (credential, metadata) and deployment context (proxy URL, Vendo-issued API key).

Variable	Profiles	Source	Secret
`SUPABASE_ACCESS_TOKEN`	all	connection credential (encrypted at rest)	Yes

Reading the credential at runtime

Supabase is composio-managed, so Vendo never holds a long-lived copy of the upstream credential — Composio does. That means process.env.SUPABASE_ACCESS_TOKEN is not populated in your running container; the env-var row above describes the SDK's credential-projection shape, not a Railway env var.

To read the credential from your tool, call vendo.token("supabase") (the SDK fetches a live access token from Composio at call time) or use the canonical vendo.data.execute path, which handles metering, connected-account resolution, and error normalization for you.

Through Composio

Calls to Supabase are brokered through Vendo's Composio bridge. Your tool issues a vendo.data.execute(ACTION, args) call; Vendo resolves the tenant's connected Supabase account, forwards to Composio, meters one composio.action_call unit, and returns the result. Your code never sees the upstream credential.

See Call a Composio Action for the full pattern, including NotConnected handling.

Quickstart

import vendo
from vendo.errors import NotConnected, UpstreamError

# Vendo brokers the call through Composio against the tenant's connected
# Supabase account. Browse the action catalog at composio.dev for the
# full list of action names.
try:
    result = vendo.data.execute(
        "SUPABASE_<ACTION>",
        { /* action-specific arguments — see composio.dev */ },
    )
except NotConnected as e:
    # Tenant hasn't connected Supabase — send them through the connect flow.
    connect_url = vendo.connect_url(e.slug)
except UpstreamError as e:
    # Composio or Supabase returned an error.
    raise

import { Vendo, NotConnected, UpstreamError } from "@vendodev/sdk";

const vendo = new Vendo();

// Vendo brokers the call through Composio against the tenant's connected
// Supabase account. Browse the action catalog at composio.dev for the
// full list of action names.
try {
  const result = await vendo.data.execute(
    "SUPABASE_<ACTION>",
    { /* action-specific arguments — see composio.dev */ },
  );
} catch (e) {
  if (e instanceof NotConnected) {
    const connectUrl = vendo.connectUrl(e.slug);
  } else if (e instanceof UpstreamError) {
    throw e;
  }
}

import VendoSDK

let vendo = Vendo()

// Vendo brokers the call through Composio against the tenant's connected
// Supabase account. Browse the action catalog at composio.dev for the
// full list of action names.
do {
  let result = try await vendo.data.execute(
    "SUPABASE_<ACTION>",
    [ /* action-specific arguments — see composio.dev */ ]
  )
} catch let error as NotConnected {
  let connectUrl = vendo.connectUrl(slug: error.slug)
} catch {
  throw error
}

Learn more

Concepts: connections & integrations — how connections, bindings, and credentials fit together.
Build a tool: SDK — full vendo.token and vendo.data.execute semantics.
Call a Composio Action — vendo.data.execute patterns and error handling.
Supabase API docs