OpenCode + Powabase

Example apps

Real apps, each from one prompt. Copy any of them and give it to OpenCode.

Where OpenCode keeps your keys

OpenCode reads its config from ~/.config/opencode/opencode.json and from an opencode.json in your project, and any value in either can pull from the environment with {env:VAR_NAME}. An unset variable becomes an empty string rather than an error. The Powabase MCP server needs no key there because it uses OAuth. Your app's Service Role key belongs in a gitignored .env that server code reads, never in anything the browser loads.

OpenCode example

// Server-side: answer a question with an agent grounded in one knowledge base.
export async function answer(agentId: string, kbId: string, message: string) {
  const key = process.env.API_KEY!; // Service Role (Secret) Key
  const res = await fetch(`${process.env.BASE_URL}/api/agents/${agentId}/run`, {
    method: "POST",
    headers: {
      apikey: key,
      Authorization: `Bearer ${key}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      message,
      knowledge_bases: [{ id: kbId, top_k: 5 }],
      citations_enabled: true,
    }),
  });
  if (!res.ok) throw new Error(`Agent run failed: ${res.status}`);
  return res.json(); // includes session_id for follow-up turns
}

The request is the same whichever model OpenCode runs. Swapping models changes the code OpenCode writes, not the API it writes against.

Connecting to Powabase from any tool

Mechanics that don’t change from tool to tool.

• Every call to /api/* or /rest/v1/* needs two headers, apikey and Authorization: Bearer, both set to the same key. Sending only one is the most common cause of a 401.

  Docs↗

• The Database URL from the Connect modal is PgBouncer in transaction mode, not a direct Postgres connection. Disable prepared statements in your driver, or you'll hit prepared statement "..." does not exist. No LISTEN/NOTIFY and no session-level SET across statements. Use Realtime for change notifications; SET LOCAL inside a transaction otherwise. The username and database in the URL are both your project ref, not postgres.

  Docs↗

• @supabase/supabase-js mostly works for the BaaS surface (PostgREST, Auth, Storage, Realtime) when you point it at your project URL with the Anon key. It doesn't cover the /api/* AI surface (agents, knowledge bases, orchestrations), which you call over plain REST. There's no /graphql/v1 route: point any GraphQL client at POST /rest/v1/rpc/graphql instead.

  Docs↗

Common errors

Powabase is in your config, but its tools never load

Cause: The automatic OAuth sign-in didn't start, or the browser tab was closed before it finished.

Fix: Run opencode mcp auth powabase to open the sign-in again, then restart the session.

A {env:...} value in opencode.json comes through blank

Cause: OpenCode replaces an unset variable with an empty string instead of failing.

Fix: Export the variable in the shell that launches OpenCode, then start OpenCode again.

401 Unauthorized

Cause: Only one of the apikey / Authorization headers was sent.

Fix: Send both, set to the same key. Docs↗

prepared statement "..." does not exist

Cause: PgBouncer's transaction-mode pooler moved you to a different server connection.

Fix: Disable prepared statements in your driver's config. Docs↗

A query that should return rows comes back empty, or a write is silently rejected

Cause: Row Level Security on your own tables. New public tables ship with RLS off, but once you add policies they gate every request.

Fix: Check the policy's USING/WITH CHECK clause and confirm which role (anon, authenticated, service_role) you actually authenticated as. Docs↗

The Service Role key turns up in a browser bundle or other client-visible code

Cause: It was used somewhere that ships to the client instead of staying server-side.

Fix: Move the call server-side; use the Anon key with RLS for anything client-visible. If it shipped, rotate it in Studio. Docs↗

FAQ