Supabase Integration

Skene connects to your Supabase project via OAuth. The default and recommended mode is read-only: Skene reads only your schema, the table, column, and type definitions, and never reads row data or writes to your database. You can point the connection at a dev or preview branch, so Skene sees the schema a change introduces and never your production data.

That schema grounds the journey Skene validates against. A branch applies that branch's migrations, so its schema reflects the change a pull request proposes, and Skene validates each PR against the schema it actually introduces. A branch still carries any table its migrations have not dropped, so it narrows stale-table noise rather than removing it. The connection gives you schema, not row values and not runtime behavior.

A separate read-write mode deploys growth-automation triggers into your database. That mode is optional and documented under Growth automation below.

How it works (read-only)

1. Connect: Link your Supabase project via OAuth from the workspace Integrations page and choose the read-only access mode.
2. Select a branch: Optionally target a dev or preview branch instead of production.
3. Ground: Skene reads the schema and grounds the journey and the validation baseline against it.
4. Validate: On each PR, Skene checks the change against the schema the branch introduces, in the same context as the code.

Prerequisites

• A Supabase project
• The pg_net extension enabled in your Supabase project (used by deployed triggers to send webhooks)
• A Skene workspace

Connect your Supabase project

1. Open Integrations

In the workspace sidebar, open Integrations (under Manage, next to Logs and API Keys). You can also go directly to /workspace/<your-slug>/integrations.

2. Choose access mode

Skene offers two OAuth access levels:

Click Connect Supabase and choose your access mode. You will be redirected to Supabase to authorize.

3. Select a project

After authorizing, you will be redirected back to Skene. If your Supabase organization has multiple projects, select the one you want to link from the dropdown.

4. Verify connection

Once linked, the Integrations page shows your connection status:

• Project ref and name
• Access mode (read-only or read-write)
• Schema status: whether the skene_growth schema and required tables are present
• Extension status: whether pg_net is enabled

Growth automation (read-write mode)

The sections below cover the optional read-write mode, where Skene deploys growth-automation triggers into your database. This is separate from the read-only validation described above. Skip it if you only need schema grounding and PR validation.

Schema setup

When you deploy your first feature, Skene creates a skene_growth schema in your Supabase project with:

You can also apply the schema migration manually from the Integrations page before deploying.

Deploying triggers

From the dashboard

1. Create or select a growth action on the Actions page.
2. Click Compile. Skene introspects your schema and generates a state machine.
3. Click Deploy. Trigger SQL is pushed to your Supabase project via the OAuth token.

From the CLI

# Analyze your codebase and generate growth loops
uvx skene analyze .
uvx skene plan
uvx skene build

# Push to Skene Cloud (which deploys triggers)
uvx skene push

What gets deployed

Each feature creates a Postgres trigger on the target table (e.g., INSERT on auth.users). The trigger:

1. Captures the row data and any enrichment context.
2. Calls net.http_post() (from pg_net) to send the event to your Skene workspace endpoint.
3. Authenticates with a per-workspace secret (skene_proxy_secret), encrypted at rest with AES-256-GCM.

Trigger reconciliation

Skene automatically reconciles triggers on each compile/deploy cycle:

• Adds triggers for new or updated features
• Removes orphan triggers no longer referenced by any feature
• Deduplicates: multiple features on the same table and operation share one trigger

Event flow

Your Supabase database
  └─ Row change fires trigger
       └─ pg_net POST -> www.skene.ai/api/v1/cloud/ingest/db-trigger
            └─ Skene runtime
                 ├─ Log raw event
                 ├─ Match to features (conditions, cooldowns, state checks)
                 ├─ Execute actions (email, webhook, state transition)
                 └─ Update journey state and logs

Events are authenticated via the x-skene-secret header, matched against the workspace's encrypted proxy secret.

Premade templates

Three templates are available to get started quickly:

Monitoring

Logs

The Logs page in your workspace shows:

• Raw ingest records with timestamps
• Which features matched each event and why
• Action dispatch results (success, failure, skipped)
• Semantic matcher audit trails for edge cases

Trigger status

The Actions page shows each loop’s deploy status, last deployed timestamp, and linked trigger ID.

Security

• OAuth tokens are encrypted with AES-256-GCM and stored in Skene's database, never in browser storage.
• Proxy secrets authenticate ingest webhooks. Each workspace has a unique secret.
• No customer data stored beyond event metadata needed for dispatch decisions.
• Read-only mode available for schema analysis without deployment risk.

Disconnecting

To unlink your Supabase project, open Integrations in the workspace sidebar and click Disconnect. This removes the OAuth tokens from Skene but does not remove deployed triggers from your database. To clean up triggers, drop the skene_growth schema:

DROP SCHEMA IF EXISTS skene_growth CASCADE;

Upgrading access mode

To switch from read-only to read-write (or vice versa), disconnect and reconnect with the desired access mode.

Troubleshooting

"pg_net extension not enabled"

Enable it from the Supabase dashboard: Database → Extensions → Search for pg_net → Enable.

Triggers not firing

1. Check that the feature is in Active status (not Draft or Paused).
2. Verify the trigger exists in your database: SELECT * FROM information_schema.triggers WHERE trigger_schema = 'skene_growth';
3. Check the Logs page for ingest errors.

OAuth token expired

Skene automatically refreshes OAuth tokens. If you see auth errors, disconnect and reconnect from the Integrations page.

Next steps

• Push: Deploy growth loops from the CLI
• MCP Server: Use skene with AI assistants
• Configuration: Config files and environment variables