fix guide
Supabase says "Email not confirmed" when logging in
Harjot ·
A user signs up, then tries to log in and sees "Email not confirmed". The account exists. Supabase refuses the login until the person confirms their address.
Supabase's docs say email confirmation is on by default for hosted projects, so a new user cannot sign in for the first time until they click the link. The error code is email_not_confirmed. Work through these five in order.
1. Check the person clicked the link
Most often the person has not clicked it yet. The email can sit in spam, in a promotions tab or at the bottom of a busy inbox. After sign-up, show a message that tells them to check their inbox, and to look in spam, before they try to log in.
Add a Resend button on the login screen. Supabase's resend call supports the signup type:
await supabase.auth.resend({ type: 'signup', email })Supabase makes the same user wait 60 seconds before asking for another confirmation email, so show a short countdown after the click.
signs Login works as soon as the person finds the email and clicks the link.
2. The email never arrived
Supabase's built-in email sender is for testing. Without custom SMTP it sends only to your project's team members and allows 2 emails an hour. Everyone else never gets the confirmation email, so they can never confirm.
Set up a real sender by following Supabase emails not sending to your users.
signs Your own team address got the email, and a friend's address did not.
3. The link expired or was used already
Links in Supabase emails last 1 hour by default and work once. The Email OTP expiration setting changes that time, and it also covers confirmation links. Some mail providers open links before the person does, which uses the link up.
If the person clicked and the page showed "Email link is invalid or has expired", read Supabase "Email link is invalid or has expired". In the meantime, send a fresh email with the Resend button from step 1.
signs The person clicked, the page showed an error, and login still says Email not confirmed.
4. The link goes to the wrong place
If the link opens localhost or an old preview address, confirmation may never finish in your live app. Supabase's docs say the Site URL is the default redirect when your code gives none, and that it is critical for email confirmations and password resets.
Fix the Site URL and Redirect URLs using step 1 of Supabase login works locally but fails in production, then test with a new sign-up.
signs The email arrives on time, but its link opens localhost or an address you no longer use.
5. Turn confirmation off only while testing
The Confirm email setting is in your Supabase Authentication settings, under Sign In / Providers. Supabase's docs say that with it on, users must confirm their email address before signing in for the first time. With it off, the email is treated as confirmed without checking.
Anyone can then sign up with any address, including one that is not theirs. That is fine on a test project while you build. Turn it back on before real users arrive.
signs Only new accounts hit the error, and in a test project, switching the setting off makes login work at once.
Test it like a new user
- Sign up with an address that is not on your Supabase team.
- Check the confirmation email arrives, and note how long it takes.
- Click the link and check it opens your live domain.
- Log in with the new account.
- Sign up again with another address, skip the email and press Resend. A new email arrives.
Common questions
Why does Supabase say Email not confirmed when I log in?
Supabase requires new users to confirm their email address before their first sign-in. The account exists, but the person has not clicked the link in the confirmation email, or the email never reached them. The error code is email_not_confirmed.
How do I resend the confirmation email?
Call supabase.auth.resend with the type signup and the person's email, and put a Resend button on the login screen. Supabase makes the same user wait 60 seconds between confirmation emails, so show a short countdown after the click.
Can I turn off email confirmation?
Yes. Switch off the Confirm email setting in the Authentication settings. Supabase then treats every address as confirmed without checking it, so anyone can sign up with an address that is not theirs. Use that only while testing, and turn it back on before real users arrive.
Still stuck?
Not sure this is the cause? Paste your app's link into the free scan. It lists what a visitor's browser can see, like leaked keys and exposed files, worst first. The score is free; every fix as a prompt for your builder is $9, one-time.
Want a person to look inside? See the diagnosis