CLI rejects new sbp_v0_... personal access token format (LegacyInvalidAccessTokenError)

[lensadmin-eng]

Bug report

The CLI's access-token format validation only accepts the legacy sbp_<hex> format and rejects the newer sbp_v0_<...> personal access token format that the dashboard's "Access Tokens" page now generates by default (Account → Access Tokens → Generate new token).

Steps to reproduce

1. Generate a Personal Access Token from the Supabase dashboard (Account → Access Tokens). It comes back in the form sbp_v0_<hex>....
2. Try any CLI command that needs it, e.g.:

   SUPABASE_ACCESS_TOKEN=sbp_v0_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx supabase functions deploy <fn> --project-ref <ref>
   

   or

   supabase login --token sbp_v0_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
   

Expected

The command authenticates and proceeds normally, same as with a legacy sbp_<hex> token.

Actual

{"_tag":"Error","error":{"code":"LegacyInvalidAccessTokenError","message":"Invalid access token format. Must be like `sbp_0102...1920`."}}

Same result from functions deploy, functions deploy --use-api, and login --token — the validation appears to run at a shared, early auth-loading layer before any command-specific logic. Passing the global --experimental flag does not change the outcome.

Confirmed it's a CLI-side check, not an invalid/expired token

The same token authenticates successfully against the Management API directly:

curl -s -H "Authorization: Bearer sbp_v0_..." "https://api.supabase.com/v1/projects"

returns the expected project list with HTTP 200.

Environment

• CLI version: 2.116.0 (installed via npx -y supabase@latest, confirmed this is the current npm latest and also the most recent GitHub release at the time of filing)
• OS: macOS
• Installed via: npx (also attempted via brew install supabase/tap/supabase, blocked separately by an unrelated outdated Xcode Command Line Tools error on this machine, not relevant to this bug)

This currently blocks deploying Edge Function updates from any machine/CI that only has a new-format PAT available, with no workaround short of somehow obtaining a legacy-format token (the dashboard's "Generate new token" button no longer offers a legacy-format option, at least not that we could find).

[sundeep8967]

Hi team! I have reproduced this issue with unit tests and prepared a fix across both next and legacy token validation patterns (apps/cli/src/next/auth/token.ts and apps/cli/src/legacy/auth/legacy-access-token.ts) to support sbp_v0_... / versioned PAT formats.

Could you please triage this issue and add the open-for-contribution label so we can submit the pull request? Thank you!