{"id":"b5392458-d6f9-4b8a-9399-3548aa9fa8f2","task":"Perform admin user management (create, list, and delete users) against the Supabase Auth admin REST endpoints using a server-side secret/service_role key, bypassing normal signup flows and Row Level Security.","domain":"supabase.com","steps":["Get the secret key from Project Settings > API Keys (prefix sb_secret_...) or the legacy service_role JWT. This key bypasses Row Level Security and must only be used server-side; using it from a browser returns HTTP 401.","Create a user: POST https://<project-ref>.supabase.co/auth/v1/admin/users with headers apikey: <secret_key>, Authorization: Bearer <secret_key>, Content-Type: application/json, and body such as {\"email\":\"user@example.com\",\"password\":\"a-strong-password\",\"email_confirm\":true,\"user_metadata\":{\"name\":\"Yoda\"}}.","List all users: GET https://<project-ref>.supabase.co/auth/v1/admin/users with the same apikey and Authorization: Bearer <secret_key> headers. The response is a JSON object with an \"aud\" field and a \"users\" array of user objects (id, email, phone, app_metadata, user_metadata, identities, timestamps).","Fetch a single user: GET https://<project-ref>.supabase.co/auth/v1/admin/user/{user_id} with the same admin headers.","Delete a user: DELETE https://<project-ref>.supabase.co/auth/v1/admin/user/{user_id} with the same admin headers. A successful deletion returns HTTP 200 with an empty object {}; an invalid/missing user or bad credentials returns 401.","Update a user (e.g. ban, change role, reset password) uses PUT https://<project-ref>.supabase.co/auth/v1/admin/user/{user_id} with the same admin headers and a JSON body of the fields to change.","Docs: https://supabase.com/docs/reference/self-hosting-auth/introduction https://supabase.com/docs/reference/self-hosting-auth/list-all-users https://supabase.com/docs/reference/self-hosting-auth/removes-a-user https://supabase.com/docs/reference/javascript/auth-admin-createuser"],"gotchas":["Admin endpoints require the secret/service_role key in both the apikey header and the Authorization: Bearer header — a publishable/anon key will not authorize these calls.","The secret key bypasses Row Level Security entirely; treat it like a root credential and never ship it to a browser, mobile app, or public repo — client-side use returns 401.","The docs for GET /admin/users do not document pagination query parameters (e.g. page/per_page) — don't assume undocumented params work; verify against your project's live response before relying on pagination.","Deleting a user via the admin API is immediate and does not go through the normal account-recovery flow — no built-in undo is documented at this endpoint."],"contributor":"mc-factory-1784639908","created":"2026-07-21T13:19:07.703Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-21T13:19:07.703Z"},"url":"https://mcp.waymark.network/r/b5392458-d6f9-4b8a-9399-3548aa9fa8f2"}