Auth & Connection

Every Powabase project keeps its connection details in one place: the Connect modal in the Studio. It holds the Project URL, both API keys (Anon and Service Role), the JWT Secret, the Database URL, and ready-to-paste Postgres connection strings in nine driver formats. Open it once, copy what you need, and you can call any part of the platform. In the Studio at app.powabase.ai, click the Connect button in the top-right of your project header.

The dialog has two tabs. API Keys lists everything you need to authenticate HTTP and Postgres clients. Connection Strings ships pre-filled snippets for psql, the generic URI, Node.js (pg), Python (psycopg2), Go (database/sql), JDBC, .NET, PHP, and SQLAlchemy: nine in all. Copy buttons sit next to every value. Secret fields hide by default; click the eye icon to reveal.

Connect to your project modal, API Keys tab. Shows Project URL, Anon (Publishable) Key, and three masked fields: Service Role (Secret) Key, JWT Secret, and Database URL. — The API Keys tab: every credential your project exposes lives here.

You can also open the modal by appending ?showConnect=true to any project URL, which is handy for deep-linking from internal docs.

Field	Use it for	Safe to ship to clients?
Project URL	The `BASE_URL` for every HTTP call — `/api/`, `/rest/v1/`, `/auth/`, `/storage/`	Yes
Anon (Publishable) Key	Client-side calls to PostgREST and Storage that respect Row Level Security	Yes
Service Role (Secret) Key	Server-side calls to `/api/*` (AI surface) and any RLS-bypassing PostgREST access	No — server only
JWT Secret	Verifying user-signed JWTs on your own backend	No — server only
Database URL	Direct Postgres access (psql, migrations, ORMs, BI tools)	No — server only

The rest of this guide uses the Service Role (Secret) Key as API_KEY. It authenticates every endpoint under /api/*, which is what most of the platform docs assume.

Never expose the Service Role key, JWT Secret, or Database URL to a browser, mobile app, or any environment outside your control. The Anon key is the only field in the modal safe to bundle into a client.

Use it from code

Set your Base URL and headers

Every request to /api/* and /rest/v1/* needs both an apikey header and an Authorization: Bearer header, set to the same key. Use the Service Role (Secret) Key for /api/* and server-side PostgREST.Endpoint: Headers: apikey + Authorization

Sending only one of the two headers is the most common cause of 401 errors. PostgREST and Kong both reject the request.

import requests

BASE_URL = "{BASE_URL}"   # Connect modal -> Project URL
API_KEY = "{API_KEY}"     # Connect modal -> Service Role (Secret) Key

headers = {
    "apikey": API_KEY,
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json",
}

const BASE_URL = "{BASE_URL}";  // Connect modal -> Project URL
const API_KEY = "{API_KEY}";    // Connect modal -> Service Role (Secret) Key

const headers = {
  apikey: API_KEY,
  Authorization: `Bearer ${API_KEY}`,
  "Content-Type": "application/json",
};

# BASE_URL -> Project URL from the Connect modal
# API_KEY  -> Service Role (Secret) Key from the Connect modal
-H "apikey: {API_KEY}" \
-H "Authorization: Bearer {API_KEY}" \
-H "Content-Type: application/json"

Verify your setup

Hit a cheap, idempotent endpoint to confirm the credentials work end-to-end. An empty array and a populated array both count as success.Endpoint: GET /api/agents

response = requests.get(
    f"{BASE_URL}/api/agents",
    headers=headers,
)
print(response.json())

const response = await fetch(`${BASE_URL}/api/agents`, { headers });
const agents = await response.json();
console.log(agents);

curl '{BASE_URL}/api/agents' \
  -H "apikey: {API_KEY}" \
  -H "Authorization: Bearer {API_KEY}"

Response:

{
  "agents": [
    {
      "id": "uuid-here",
      "name": "My Agent",
      "model": "gpt-4o",
      "created_at": "2026-01-01T00:00:00Z"
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}

Connect directly to Postgres (optional)

For migrations, dashboards, ORMs, or any tool that speaks the Postgres wire protocol, grab the Database URL from the API Keys tab, or open the Connection Strings tab and copy a pre-built snippet in your language. Use this from servers and trusted environments only.Endpoint: Postgres wire protocol

The Database URL embeds the database password in cleartext. Treat it like the Service Role key: never commit it, never expose it client-side, and rotate the database password (Studio → Settings → Database) if it leaks.

# Python (psycopg2) — from Connection Strings -> Python
import psycopg2

conn = psycopg2.connect("{POSTGRES_URL}")  # Database URL from the Connect modal
with conn.cursor() as cur:
    cur.execute("select count(*) from public.users")
    print(cur.fetchone())

// Node.js (pg) — from Connection Strings -> Node.js
import { Client } from "pg";

const client = new Client({ connectionString: "{POSTGRES_URL}" });  // Database URL
await client.connect();
const { rows } = await client.query("select count(*) from public.users");
console.log(rows);

# psql — from Connection Strings -> PSQL
psql "{POSTGRES_URL}"

What’s Next

Quickstart

Build an end-to-end RAG agent in 5 minutes.

Database Access

AI schema vs public schema, plus PostgREST and direct Postgres usage.

Architecture

How Kong routes /api/, /rest/v1/, /auth/, and /storage/ to your project’s stack.

Getting Started

Concepts

Guides

API Reference

Auth & Connection

Use it from code

What’s Next

Quickstart

Database Access

Architecture

​Open the Connect modal

​What’s in the modal, and where to use each value

​Use it from code

​What’s Next

Quickstart

Database Access

Architecture

Open the Connect modal

What’s in the modal, and where to use each value

Use it from code

What’s Next