All API templates

Supabase (PostgREST) template

Ready-made app rules, included on Free and Pro.

Project upstream: https://YOUR-PROJECT.supabase.co/rest/v1. Suggested limit: 60 calls per minute.

Replace YOUR-PROJECT with your project reference. Configure the project apikey header; keep row-level security enabled and use a restricted key. Gate replaces client Authorization with the app key, so upstream user JWT passthrough is not provided by this template. :table covers every exposed table/view: narrow explicit routes for your schema. Query rules cannot express “a filter must exist”, so every DELETE is refused, including filtered deletes. RPC calls are refused because functions may write.

What the agent may do

• GET /:table — Vendor documentation
• HEAD /:table — Vendor documentation

What waits for approval

• POST /:table — Vendor documentation
• PATCH /:table — Vendor documentation

These writes wait with 202 approval_required when called with the app key. Add a separate human approver with gate_add_approver or the dashboard. The person signs in with their approver key, reviews the exact call and approves or rejects it. The agent then resends the identical call with x-odile-action. No run token is needed unless the owner separately requires runs for this app.

What is refused

• DELETE /:table — Vendor documentation
• POST /rpc/:function — Vendor documentation
• GET /rpc/:function — Vendor documentation

Calls outside the allowed and approval lists are also refused.

Apply this template

Use an existing project configured with the upstream above and the provider's required credentials. Configure credentials separately; applying a template does not change the project's upstream or secret. Keep the admin key with the owner and give the agent only its returned app key.

The template supplies the rules and suggested per_minute limit. An explicit routes list in the same request replaces the entire template policy, including approval requirements. An explicit per_minute overrides the suggested limit.

MCP call

Call gate_create_app through the Gate MCP server, replacing the project and admin-key placeholders:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "gate_create_app",
    "arguments": {
      "project_id": "<project-id>",
      "admin_key": "<admin-key>",
      "name": "supabase-agent",
      "template": "supabase"
    }
  }
}

curl

Set PROJECT to your existing project ID and load ADMIN from your locally stored admin key, then run:

curl -X POST "https://gate.odilelabs.com/api/projects/$PROJECT/apps" \
  -H "Authorization: Bearer $ADMIN" -H "content-type: application/json" \
  -d '{"name":"supabase-agent","template":"supabase"}'