Limitations

SupaClone is not a perfect one-click copy of everything

Supabase projects contain platform-managed, security-sensitive, and environment-specific resources. Some of those resources should not be copied automatically.

SupaClone aims to make the safe clone path explicit and to report manual steps instead of pretending every resource transferred perfectly.

Current limitations

• Auth users, identities, sessions, passwords, and tokens are not cloned.
• Secrets are not copied automatically.
• Supabase-managed schemas are excluded.
• Realtime settings may require manual review.
• API keys are not cloned.
• Billing, organization membership, and dashboard roles are not cloned.
• Unknown future Auth config fields are not copied until reviewed.
• Large data or Storage clones may be constrained by runtime, network, or Supabase API behavior.
• Existing target data is not merged.
• Rollback is manual; use disposable target projects.

Data limitations

Data cloning can be scoped, but it is not a full logical replication system. If your data has references to resources outside the clone scope, you may need manual cleanup or target seed data.

Foreign keys into managed schemas such as auth.users deserve particular review because Auth users are not copied.

Platform API limitations

Some Supabase APIs do not expose every setting through OAuth or may expose only masked values. When SupaClone cannot safely read or compare a resource, it reports a manual step or notice.

What to do when a limitation matters

Use the clone report as your checklist:

1. Fix manual steps in the target.
2. Re-run application tests.
3. Verify RLS behavior.
4. Check Edge Function logs.
5. Validate Auth provider callbacks and Storage access.