Tenant or user not found: Supabase fix

The short answer

Tenant or user not found means Supabase’s shared pooler could not match the host and username to one project. It is normally a connection-string mismatch, not a wrong password. On the shared pooler, the username must include the project ref: postgres.<ref>, or <role>.<ref> for a custom role.

The fix is to open the Supabase Connect dialog, choose Session pooler or Transaction pooler, and copy the whole string. Replace only the password placeholder. For the full host and username table, see the Supabase connection string guide.

What the error means

Supabase’s tenant troubleshooting guide describes this as the shared pooler failing to match the host and username to a project. The message depends on the client. Supabase’s guide says some drivers report it as FATAL: (ENOTFOUND) tenant/user postgres.<project-ref> not found. In our test, node-postgres returned (ENOTFOUND) tenant/user postgres.aaaaaaaaaaaaaaaaaaaa not found with severity FATAL. The same lookup can also return Tenant or user not found, or ENOIDENTIFIER when the username has no project ref at all.

That (ENOTFOUND) tenant/user ... not found text is a pooler lookup error. It is unrelated to the DNS error getaddrinfo ENOTFOUND db.<ref>.supabase.co; for that failure, see the Supabase getaddrinfo ENOTFOUND fix.

All of these fail before password authentication. The pooler needs enough information to find your project before it can authenticate the role. That is why resetting the database password does not fix a missing project ref. Supabase’s guide makes the same point: the error sends people to reset a password that was never wrong.

If the message says ENOIDENTIFIER

The exact message is:

(ENOIDENTIFIER) no tenant identifier provided (external_id or sni_hostname required)

This means the username had no project ref at all. On the shared pooler, plain postgres gives the pooler nothing to look up. It is not the same string as Tenant or user not found, but it is the same tenant-identification failure, and the fix is the same: copy the shared pooler username in the form postgres.<ref> or <role>.<ref>.

Cause 1: the username is missing the project ref

Shared pooler connections use postgres.<project-ref>, not plain postgres. Direct connections and the paid dedicated pooler use plain postgres. Custom roles follow the same rule as the shared pooler: <role>.<project-ref>.

This is the most common cause because the shared pooler username looks almost identical to the direct username. The project ref is the part that identifies the tenant.

Cause 2: the host was typed, not copied

Shared pooler hosts look like aws-1-us-east-2.pooler.supabase.com. The number is a pooler cluster index, not part of the region name. A region can have more than one, and aws-0 is not a safe default. You cannot derive the host from the region.

If the host and username come from different screens, different projects, or different connection modes, the pooler can receive a valid host with the wrong tenant or a valid tenant with the wrong host. Copy both values from the same Connect string.

Cause 3: the mode, host, username, and port do not match

Supabase has four connection paths, and each has a matching host, port, and username. The shared pooler is IPv4 and uses postgres.<ref>. Port 5432 is session mode; port 6543 is transaction mode. The paid dedicated pooler also uses port 6543, but it uses plain postgres and the db.<ref>.supabase.co host.

Do not mix a direct host with a pooled username. Do not mix a session host with a transaction username. The error appears before password authentication, so the password is not the useful thing to change first.

How to fix it, with a check after each step

1. Open Connect and choose the mode. Use Session pooler for a persistent backend on IPv4, or Transaction pooler for serverless. Check: the string says pooler.supabase.com, not db.<ref>.supabase.co, unless you chose the dedicated pooler.
2. Check the username. Shared session and shared transaction must use postgres.<ref> or <role>.<ref>. Direct and dedicated use postgres. Check: the username contains the project ref exactly where the Connect dialog shows it.
3. Check the port. Shared session is 5432; shared transaction is 6543. Check: the port matches the mode you selected, not just the port you remember.
4. Connect and run select 1. Check: the query returns. If it still returns the exact tenant error with a copied host, username, and port, stop changing the password.
5. Contact Supabase support. Include the project ref, exact error, pooler host, username, port, and the time of the attempt. The tenant guide documents host and username causes; it does not provide a self-service resync when both are already correct. Open a support ticket.

Why resetting the password is the wrong first move

The pooler has to identify the project before it can check a password for a role in that project. A missing project ref means there is no tenant to authenticate against. Reset the password only after the host, username, and port match a single Connect string and you get a different error, such as password authentication failed.

Tested on

Reproduced 2026-10-25 against Supabase’s shared pooler (aws-0-ap-northeast-1, port 5432). Both attempts used a placeholder password, so they test tenant identification, not password authentication.

• Username postgres (no project ref):

  (ENOIDENTIFIER) no tenant identifier provided (external_id or sni_hostname required)

  The connection string was postgresql://postgres:YOUR_PASSWORD@aws-0-ap-northeast-1.pooler.supabase.com:5432/postgres.

• Username postgres.aaaaaaaaaaaaaaaaaaaa (non-existent 20-character ref):

  (ENOTFOUND) tenant/user postgres.aaaaaaaaaaaaaaaaaaaa not found

  This attempt used the same host, port, database, and placeholder password.

Sources

• Supabase: Tenant or user not found when connecting through the shared pooler
• Supabase: Connect to your database
• Supabase: New support ticket

Not sure which mode your string uses? Paste it into the PostgreSQL connection string checker to see the host, port, and username before you connect.