• Suppose the customer uses Supabase for their applications.
• iCompaas connects to their Supabase organization, reads accessible settings, and evaluates security and compliance checks.
• The connection uses OAuth. The customer signs in to Supabase and approves access—there is no need to create API keys or paste tokens into iCompaas.

2. Prerequisites

• A Supabase user with permission to approve access to that organization.
• An iCompaas account with permission to manage integrations.
• Signed in to iCompaas in the same browser, with pop-ups allowed.

3. The Complete Onboarding Flow

• Let's say the customer is Zato, and Zato uses Supabase for its application projects.
• In iCompaas, the customer opens Onboarding → Application account setup.
• They select Supabase and click Connect Supabase.
• The Supabase authorization page opens.
• The customer signs in, reviews the requested permissions, and approves access to the intended organization.
• Supabase redirects the customer back to iCompaas.
• iCompaas securely saves the connection and checks whether it can access the organization and required project settings.
• Once validation succeeds, the connection shows Connected, and the first scan starts automatically.
• The scan collects settings and evaluates the supported security checks.
• After the scan and assessment finish, the results can be included in a newly generated compliance report.

Connected means access is confirmed. It does not mean the scan or report is already complete.

4. What iCompaas Checks

• Organization security: member MFA and organization SSO.
• Authentication: password settings, email confirmation, CAPTCHA, MFA availability, and trusted redirect URLs.
• API keys: key rotation and whether legacy keys are enabled.
• Database security: Row Level Security, access policies, network restrictions, SSL enforcement, and database configuration.
• Storage security: bucket visibility, file-size limits, and allowed file types.
• Backups and recovery: automated daily backups and Point-in-Time Recovery.
• Logging: audit logging and log-retention settings.
• Edge Functions: JWT verification settings.

Some features depend on the customer's Supabase plan. Each finding explains the available evidence and why the check passed, failed, or could not be evaluated.

5. Understanding Connection and Check Statuses

Connection statuses:

• Pending: access validation has not finished.
• Connected: the connection is validated and usable.
• Invalid: the credentials or required access were rejected.

Check results:

• Passed: the result meets the check's requirements.
• Failed: the result does not meet the check's requirements.

6. Troubleshooting

• The connection window does not open: allow pop-ups for iCompaas and try again.
• You are asked to sign in to iCompaas: sign in in the same browser, then retry.
• The connection stays Pending: validation has not completed. Contact support if it remains pending.
• The connection is saved but shows an error: check the project in Supabase. If it is paused, resume it and retry. If the organization has no projects, create one before onboarding. If the project is running and the error continues, contact support.
• The connection shows Invalid: use Reconnect on the existing connection when reauthorization is needed. Avoid creating another connection just to retry.
• The connection is Connected, but results are unavailable: confirm that the scan and assessment have finished, then request a new report.
• A check mentions a plan restriction: review the Supabase plan requirements for that feature.

When contacting support, share the connection name or ID and the time of the error. Never share access tokens, refresh tokens, or secret keys.