Files
supabase/apps/docs/content/troubleshooting/supabase-cli-failed-sasl-auth-or-invalid-scram-server-final-message.mdx
Andrew Valleteau 84268aa810 docs(cli): document beta channel install and link SASL troubleshooting (#45734)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES/NO

## What kind of change does this PR introduce?

Bug fix, feature, docs update, ...

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added Beta channel section documenting pre-release Supabase CLI
installation for macOS, Windows, Linux, and npm.
* Updated CLI update instructions with beta-specific commands for
Homebrew, Scoop, and npm.
* Enhanced troubleshooting guide with reference to beta channel
documentation.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45734)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: avallete <8771783+avallete@users.noreply.github.com>
2026-05-11 16:43:00 +02:00

33 lines
1.9 KiB
Plaintext

---
title = "Supabase CLI: \"failed SASL auth\" or \"invalid SCRAM server-final-message\""
topics = [ "auth", "cli", "database", "supavisor" ]
keywords = []
database_id = "4a32736f-1d7f-4c41-9c96-ab84e35ad394"
---
When executing `supabase db push` or `supabase link` or any other authenticated actions from the Supabase CLI, you might encounter an authentication error with messages such as `failed SASL auth (invalid SCRAM server-final-message received from server)`.
**Why This Occurs:**
This typically indicates an authentication failure where the database connection pooler (Supavisor) in certain scenarios may be incorrectly caching credentials for the internal Supabase role `cli_login_postgres` used for password-less flows with the CLI. This can lead to the your IP being temporarily banned from repeated failed attempts to connect.
**To resolve this, consider one of the following solutions:**
1. **Check Network Bans:**
- Navigate to your project's [Database Settings](/dashboard/project/_/database/settings) page.
- Review any listed IP addresses that are blocked. Remove any entries that correspond to your current connection and then try the CLI action again.
2. **Use the old Password-Based authentication flow instead:**
- Provide your database password directly through an environment variable when running the CLI command.
```bash
SUPABASE_DB_PASSWORD=<your-database-password> supabase db push
```
3. **Skip the Pooler and connect directly to the database with the Supabase CLI (Requires IPv6):**
- If your network supports IPv6, you can use the beta CLI version with the `--skip-pooler` flag to bypass the connection pooler to avoid this particular issue. Install options are documented under [Beta channel](/docs/guides/local-development/cli/getting-started#beta-channel) in the CLI getting started guide.
```bash
npx supabase@beta link --skip-pooler
npx supabase@beta db push
```