Created by Carol Monroe - Lovable Champion and Supabase SupaSquad Member The full migration was verified on a real end-to-end migration (12 tables, 237 rows, 23 users, 40 storage files, 5 edge functions, 2 cron jobs) on 2026-07-06. Password-hash access through Lovable MCP was rechecked on 2026-08-31 without exposing any hash values.
What Changed in v4.1.2 (August 2026)
Lovable's official documentation says that user passwords are not exported in a usable form and recommends a password-reset flow for migrated users. This skill therefore treats password reset as the default path.
The native export is still the primary source for the database, but it must never be presented as a password-preserving export.
An optional advanced route remains available when Lovable MCP query_database
can read
auth.users.encrypted_password on supported Cloud projects. A boolean-only
capability check succeeded on 2026-08-31, and the complete hash-preserving flow
was previously verified in March and July 2026. This route is optional,
sensitive, and subject to change because Lovable MCP is a research preview.
What Changed in v4 (July 2026)
Lovable shipped official Export, Pause, and Remove buttons for Cloud (Cloud tab > Overview > Advanced settings). Lovable Cloud is no longer permanent. This rewrites the migration playbook:
- The old "Cloud can never be disconnected" fact is obsolete. You can now export your database, remove Cloud from the SAME project, and connect your own Supabase.
- The native export file (a
pg_dumpcustom-format backup) is now the PRIMARY database source. Do not assume it preserves usable passwords. Follow the official reset path by default, or explicitly opt into the advanced MCP hash route after a capability check and security confirmation. - The old 68-step MCP migration into a fresh Lovable project is now the FALLBACK path, kept for the cases the native export cannot serve.
Naming note: this skill keeps the name lovable-cloud-migration on purpose so v4
REPLACES any earlier install of the same skill (whose "Cloud is permanent" guidance
is now obsolete) instead of coexisting with it. If both this and an older copy are
somehow present, this one wins - delete the older one.
What This Skill Does
Migrates an entire Lovable Cloud project to your own Supabase: database schema, data, RLS policies, functions, triggers, sequences, auth users and identities, storage buckets and files, edge functions with correct per-function verify_jwt, cron jobs, and secrets inventory. Then removes Cloud and connects the user's own Supabase to the same Lovable project. Passwords use the official reset path by default; the advanced MCP route can preserve existing hashes when available and explicitly approved.
Decision Point (ALWAYS start here)
Ask what the user actually needs, then pick the path:
| User's situation | Path |
|---|---|
| "My app burns credits while I'm not working on it" | No migration. Pause Cloud (Cloud tab > Overview > Advanced settings). Done. |
| "I want backups of my Cloud data" | No migration. Export project data works standalone, once per 24h, keep building on Cloud. |
| Ready to run on own Supabase, database ≤ 5 GB | SAME-PROJECT PATH (primary, below): Export + auth decision + Remove + Connect on the existing Lovable project. |
| Database > 5 GB, export unavailable/failing, or user wants the original Cloud project kept untouched | FRESH-PROJECT PATH (legacy fallback): full MCP migration into a new Lovable project. See references/fresh-project-path.md. |
Remind the user: Export/Pause/Remove buttons cost no credits. Only agent prompts do.
Why Migrate at All (the right reasons)
Lovable Cloud is a solid managed backend. Migration makes sense when the project needs things only a full Supabase setup provides:
| You want to... | Why it needs your own Supabase |
|---|---|
| Customize auth emails (sender, design, content) | Cloud sends from no-reply@auth.lovable.cloud |
| Access the full Supabase dashboard | SQL editor, extensions, logs, monitoring |
| Use the service role key | Admin operations and some edge functions |
| Have staging + production environments | Cloud is one database per project |
| Own your infrastructure long-term | Your project, your org, your billing |
If none of these apply and the user is happy on Cloud, say so: there is no need to migrate, and Export-as-backup + Pause cover most worries now.
Prerequisites
| Requirement | Needed for | How to set up |
|---|---|---|
| Lovable account with Cloud enabled | Everything | - |
| Supabase account | Everything | https://supabase.com |
| GitHub connected to the project | Everything (function code travels via the repo) | Editor > + menu > GitHub > Connect |
| Lovable MCP | Strongly recommended for inventory and source-side checks; required for the optional password-hash preservation route | /mcp in Claude Code, or claude.ai Settings > Connectors - https://docs.lovable.dev/integrations/mcp-servers |
| Supabase MCP | Destination-side automation (create project, run every verification) | Built into Claude Code - https://supabase.com/docs/guides/getting-started/mcp |
| pg_restore 16+ with zstd | Same-project path Step 14 | macOS: brew install postgresql@18 |
GitHub CLI (gh) |
Fresh-project path only | brew install gh + gh auth login |
| Supabase CLI | Optional - faster function deploys and storage uploads | https://supabase.com/docs/guides/getting-started |
Works in Claude Code and claude.ai, and also in other MCP-compatible agents like Cursor. Without any MCP, the same-project path still works - the user reads the counts off the Cloud panel by hand and Claude guides the terminal steps.
Choose Migration Level
Ask the user which level they want before starting:
| Level | Audience | Behavior |
|---|---|---|
| Guided | First migration, not technical | Explain each phase, confirm before proceeding, show what is happening |
| Standard | Knows Supabase/Lovable | Confirm key decisions, run phases with minimal pauses |
| Express | Advanced, done it before | Ask for source + destination, run everything, report at the gate |
Every level stops at the same hard checkpoints: cost confirmation, the Phase 7 gate, and the Remove click.
Key Facts
The native export
- Format:
pg_dumpv18 custom format with zstd compression (source Postgres 17). - Restoring requires
pg_restorev16+ built with zstd. The libpq build from Homebrew does NOT include zstd and fails with "does not support compression with zstd" even when the version number looks fine. Usepostgresql@18(Trap 18). - Lovable's documentation says password material is not exported in a usable form. Treat the export as carrying users, not usable passwords, and plan resets unless the optional MCP route is completed and verified.
- INCLUDED for the supported database flow: schema and data, RLS policies, triggers, custom functions, sequences, cron and storage metadata. Verify every component against the baseline because the export contract can change.
- NOT included: storage FILES (actual bytes), edge function CODE (lives in the repo), edge function SECRET values, vault secret VALUES (rows restore but are encrypted with the old project's key, unrecoverable cross-project).
- The export saves INTO the project's own Cloud storage as a bucket named like
database_export_06_07_26. Download it before removing Cloud - it dies with Cloud (Trap 17). Limits: 5 GB, one export per 24 hours. - The "we'll email you" toast is unreliable. Don't wait for the email: check Storage for the export bucket (~1 minute for a small database).
Passwords: official default vs advanced MCP route
- Official default: Lovable says passwords are not exported in a usable form. Build and test a password-reset flow before removing Cloud.
- Advanced option: Run a capability check that returns only counts, never hashes. If non-empty hashes are accessible, explain that the values will pass through MCP/agent execution, obtain explicit approval, then migrate only the minimum required auth fields.
- Never paste hashes into chat, print them, commit them, or store them in a normal project folder. Delete protected temporary artifacts after the login test.
- If the capability check fails, the agent cannot guarantee secret-safe handling, or any expected password user lacks a hash, use the reset path for that user. OAuth and passwordless users may correctly have no hash. Do not improvise passwords.
The Lovable side
- After connecting an own Supabase, the Lovable agent CAN deploy edge functions to it (confirmed directly with the agent, config.toml respected). It CANNOT set edge function secrets - only the user can, in the Supabase dashboard.
LOVABLE_API_KEYis a managed WORKSPACE secret, independent of Cloud. It SURVIVES Cloud removal. AI features keep working after re-wiring (Trap 25).- Connecting the Supabase integration auto-rewrites
.env(correct URL + key, no manual editing). But it may also overwritesrc/integrations/supabase/client.tswith a template that breaks SSR on modern (TanStack) stack projects (Trap 23). - GitHub sync is two-way. Temporary helper functions you delete in Supabase come BACK if they still live in the repo - delete them everywhere (Trap 24).
- Remix still does NOT work for migration - it inherits Lovable Cloud.
Security
- The
.backupfile contains personal and authentication data and may contain sensitive credential material. Treat it like a password: keep it local, never commit it, delete it after the migration. - If the database password touched a chat, a script, or an AI session during the migration, rotate it at the end (Dashboard > Settings > Database).
- Before pushing any migration artifacts to a public repo, scan them for project refs, keys, emails, and personal data.
THE SACRED ORDER
1. EXPORT the database (button)
2. DOWNLOAD the export + the storage files ← they live inside Cloud
3. BUILD the new Supabase (restore, fix, upload, deploy)
4. AUTH test password reset, or explicitly run the MCP hash route
5. VERIFY the 12-count gate — ALL GREEN or stop
6. REMOVE Lovable Cloud ← only now, nothing before this is destructive
7. CONNECT your own Supabase to the same project
Nothing is removed until its replacement is alive and verified. At every step before 6, the app still runs on Cloud, untouched. If any step fails, stop and fix - Cloud is the safety net until the gate is green.
SAME-PROJECT PATH (primary)
The full 33-step playbook lives in references/same-project-path.md. Read it when actually running the migration. The shape:
| Phase | Steps | What happens | Human moments |
|---|---|---|---|
| 1. Baseline + GitHub | 1-4 | 12-count inventory, repo connected, verify_jwt + secrets map | Connect GitHub if missing |
| 2. Export + Download | 5-8 | Official export triggered, found in Storage, downloaded, storage files downloaded | Export click, downloads |
| 3. Create destination | 9-12 | Supabase project, session pooler connection string | Confirm cost |
| 4. Restore | 13-16 | zstd-capable pg_restore, identities fix pass, auth decision, snapshot check | Approve advanced hash route or use reset |
| 5. Post-restore fixups | 17-21 | Cron recreate + zombie hunt, ghost rows cleared, files uploaded, URLs rewritten, sequences | - |
| 6. Functions + secrets | 22-25 | Deploy (CLI/MCP/agent), secrets re-entered, AI re-wired, temp helpers deleted everywhere | Enter secrets |
| 7. THE GATE | 26-28 | 12-category audit vs baseline + tested auth path + image opens | Gate decision |
| 8. Remove + Connect | 29-33 | Remove Cloud, connect own Supabase, fix integration overwrite, final tidy | Remove + Connect clicks |
Hard stops (never skip, at any migration level)
- Cost confirmation before creating the Supabase project (Step 9).
- The gate (Step 28): every count green + one tested login through the chosen auth path (original password after MCP preservation, or completed reset), or DO NOT proceed. Cloud stays as the safety net.
- Remove is the only destructive click (Step 29) and it is always the user's hand, never automated, never before the gate.
When to read what
| Situation | Read |
|---|---|
| Running the primary migration | references/same-project-path.md |
| Export unavailable, DB > 5 GB, or original project must stay untouched | references/fresh-project-path.md |
| Choosing/comparing export methods | references/export-methods.md |
| Storage helper function (fresh-project path) | references/migrate-storage-function.md |
| A symptom needs a fix | Symptoms table in references/same-project-path.md, then references/troubleshooting.md |
FRESH-PROJECT PATH (legacy fallback)
The complete v3.1 flow - 68 deterministic steps, 9 phases, MCP-driven scan and rebuild into a NEW Lovable project - lives in references/fresh-project-path.md.
Use it when:
- The database exceeds the 5 GB export cap (also: email support@lovable.dev with the project ID for a manual export).
- The export feature is unavailable or failing for the project.
- The user wants the original Cloud project kept running/untouched (staging-style migration with zero risk to the original).
That reference keeps its own trap table (Traps 1-16) and troubleshooting rows.
Traps Added in v4 (17-26, all hit and verified live)
| Trap | Severity | Description | Prevention |
|---|---|---|---|
| 17 | Critical | Export saves INTO Cloud storage - Remove deletes it | Sacred order: Export -> DOWNLOAD -> Remove last (Steps 5-7, 29) |
| 18 | Blocker | brew libpq pg_restore lacks zstd, fails on the .backup | Test with pg_restore --list first; postgresql@18 (Step 13) |
| 19 | Critical | auth.identities dropped by restore FK ordering | Count check + second data-only pass (Step 15) |
| 20 | Silent bug | cron.job restore = permission denied; restored/recreated commands point at OLD project URL and run against a dead endpoint | cron.schedule + zombie hunt + cron.alter_job (Step 17) |
| 21 | Silent bug | storage.objects ghost rows block uploads ("resource already exists"); protect_delete blocks SQL DELETE | Clear via Storage API/CLI before upload, never SQL (Step 18) |
| 22 | Silent bug | Signed URLs (?token=) die with the old project; text-replace makes them LOOK migrated | Regenerate or NULL, never rewrite (Step 20) |
| 23 | Breaker | Supabase integration overwrites client.ts, breaks SSR on modern stack | Post-connect fix prompt with explicit Do NOTs (Step 31) |
| 24 | Zombie | Temp helper functions replicate back via two-way GitHub sync | Delete in Supabase AND in the repo (Step 25) |
| 25 | Surprise (good) | LOVABLE_API_KEY survives Cloud removal (workspace secret) | Re-wire: server functions (recommended) or copy the key (Step 24) |
| 26 | Data loss | Restore is a snapshot at EXPORT time; later writes are missing | Ask when writes stopped; re-export or re-apply deltas (Step 16) |
Trap Added in v4.1
| Trap | Severity | Description | Prevention |
|---|---|---|---|
| 27 | Account lockout | Current Lovable docs say official exports do not contain usable passwords | Default to reset; use the MCP hash route only after capability check, explicit approval, and secure handling |
Human Assistance Points (same-project path)
| Step | What the user must do | Why not automated |
|---|---|---|
| 1 | Connect GitHub in the editor | Dashboard-only flow |
| 5 | Click Export project data | Dashboard-only button |
| 7 | Download the export zip | Browser download |
| 8 | Download storage files (small projects) | Browser download (scriptable for large) |
| 23 | Enter edge function secrets | No MCP/agent can set secrets |
| 29 | Click Remove Lovable Cloud | Destructive, deliberately manual |
| 30 | Connect own Supabase | Dashboard OAuth flow |
| 33 | OAuth providers, JWT secret | Dashboard-only settings |
| Cost | Confirm Supabase project cost | MCP requires explicit confirmation |
Plan Requirements
| Tool | Plan needed | Cost |
|---|---|---|
| Lovable | Any plan with Cloud | Varies |
| Supabase | Free works if slot available | $0-$10/mo |
| Claude Code (optional, automates everything) | Pro or Max | $20/mo+ |
| claude.ai (optional, no-CLI route) | Free/Pro | $0+ |
| GitHub | Free | $0 |
Documentation Links
| Resource | URL |
|---|---|
| Lovable Cloud advanced settings (export, pause, remove) | https://docs.lovable.dev/features/advanced-settings |
| Lovable GitHub integration | https://docs.lovable.dev/integrations/github |
| Lovable MCP | https://docs.lovable.dev/integrations/mcp-servers |
| Supabase: restore a backup | https://supabase.com/docs/guides/platform/migrating-within-supabase/dashboard-restore |
| Supabase: database backups | https://supabase.com/docs/guides/platform/backups |
| Supabase MCP | https://supabase.com/docs/guides/getting-started/mcp |
| Supabase Edge Functions | https://supabase.com/docs/guides/functions |
| Supabase Storage | https://supabase.com/docs/guides/storage |
| Supabase Auth | https://supabase.com/docs/guides/auth |
Resources by Carol Monroe
- The manual walkthrough this skill automates: https://carolmonroe.com/blog/export-remove-lovable-cloud
- Migrate with AI guide (claude.ai route + Claude Code route): https://carolmonroe.com/blog/migrate-lovable-cloud-with-ai
- Legacy MCP migration guide (fresh-project path): https://carolmonroe.com/blog/lovable-cloud-mcp-migration
- MCP setup for claude.ai chat: https://carolmonroe.com/blog/connect-lovable-supabase-mcp-to-claude