> ## Documentation Index
> Fetch the complete documentation index at: https://docs-stg.outerlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-host OuterLayer (preview)

> Self-hosting the dashboard, gateway and database is not available yet. This preview lists the Supabase Auth settings it will need.

<Note>
  Self-hosting the platform is not available yet. To run builds on your own machines today, use [self-hosted runners](/run-work-on-your-machines). The platform stays at app.outerlayer.ai, and each build runs on a machine you control.
</Note>

## Install against your own Supabase

A self-hosted OuterLayer connects to a Supabase you already have: Supabase Cloud, Supabase's own self-hosted stack, or the Supabase CLI. A container applies OuterLayer's database migrations to it. The steps live in [`docker/README.md`](https://github.com/outerlayerai/outerlayer/blob/main/docker/README.md), which covers the compose stack and the environment file.

## Auth settings your Supabase needs

The Supabase CLI reads these settings from `config.toml`, so a CLI install needs no manual step. A Supabase you bring does. Turn each one on in your project before you sign in.

* **Custom access token hook.** Turn it on and point it at the Postgres function `public.custom_access_token_hook`, which the migrations create. On Supabase Cloud, set it under `Authentication > Hooks`. On Supabase's self-hosted stack, set `GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED=true` and `GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI=pg-functions://postgres/public/custom_access_token_hook` on the auth service. Without the hook, the dashboard shows an error that names it.
* **OAuth server.** Turn it on with the authorization path `/oauth/consent`. It backs the MCP connector sign-in, and it is in beta on Supabase Cloud. On Supabase Cloud, set it under `Authentication > OAuth Server`. On the self-hosted stack, set `GOTRUE_OAUTH_SERVER_ENABLED=true` and `GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH=/oauth/consent`.
* **Dynamic client registration.** Leave it off. While it is on, any caller that can reach your Auth URL can register an OAuth client. It is part of the same OAuth server settings, and `GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION=false` turns it off on the self-hosted stack.
* **`site_url`.** Set it to the URL people open the dashboard at. On Supabase Cloud, set the Site URL under `Authentication > URL Configuration`. On the self-hosted stack, set `GOTRUE_SITE_URL`.
* **Redirect URLs.** Add `<dashboard URL>/auth/callback` for each address the dashboard is served from. On Supabase Cloud, add them under `Authentication > URL Configuration`. On the self-hosted stack, set `GOTRUE_URI_ALLOW_LIST`.

## Evidence comments arrive later

A self-hosted platform has no message queue. Because of that, a build's uploaded artifacts reach the pull request's evidence comment late. They arrive only on the pull request's next GitHub event or the next run of `/api/cron/pr-comment-sweep`. The hosted platform runs that sweep hourly, but the compose stack does not schedule it. Builds are not held up, because `outerlayer sync` prints each artifact's link as it uploads it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.