Scoped tokens: supabase link needs API Key Secrets even though db push only needs the DB password #7165

Affected area

Auth

Supabase CLI version

2.108.0

Operating system

Ubuntu 24.04 (GitHub Actions ubuntu-latest); also reproduced on Windows 11

Installation method

None

Command

SUPABASE_ACCESS_TOKEN=<project-scoped PAT> supabase link --project-ref <ref> --debug

Actual output

Using access token from env var...
Supabase CLI 2.120.0
HTTP GET: https://api.supabase.com/v1/projects/<ref>
HTTP GET: https://api.supabase.com/v1/projects/<ref>/api-keys
Authorization failed for the access token and project ref pair: {"message":"Your account does not have the necessary privileges to access this endpoint. For more details, refer to our documentation https://supabase.com/docs/guides/platform/access-control"}

Expected behavior

supabase link (followed by supabase db push) works with a project-scoped token that has Migrations read-write and project/database read, without needing API Key Secrets. db push uses the database password and never needs the secret service_role key, so link shouldn't fetch secret keys, or should skip them when the token lacks API Key Secrets. If a permission is missing, the 403 should name it in missing_permissions, as the docs say.

Steps to reproduce

1. Create a scoped personal access token (resource access: one project) with: Migrations read-write; Project Settings, Database, Database Config, Connection Pooling, API Keys read. Created by the organization Owner.
2. Run: SUPABASE_ACCESS_TOKEN= supabase link --project-ref --debug
3. It fails on GET /v1/projects//api-keys with "Your account does not have the necessary privileges to access this endpoint".
4. Add API Key Secrets: read to a new token → link succeeds.
   Workaround: supabase db push --db-url (no link, no token).

Crash report ID

No response

Docker and service versions

Additional context

No response