fix guide
Supabase emails not sending to your users
Harjot · · updated
Someone signs up and never gets the confirmation email. Or the password reset arrives for you and nobody else. If your app uses Supabase Auth, these emails come from Supabase, not from Lovable or Bolt, so the fix sits in your Supabase project.
Supabase ships a built-in email sender for trying things out. Its docs say it is not meant for production, so real users need a custom SMTP service. Work through the five steps in order. Steps 1 and 2 tell you which problem you have.
1. Only your team gets the email
Supabase's docs say that unless you set up a custom SMTP server, Supabase Auth refuses to deliver messages to addresses that are not part of the project's team. Team members are managed in the Team tab of the organization's settings.
Those other addresses fail with the error "Email address not authorized." For testing, you can add an address to your team in that tab.
To check, sign up with your own team email, then with a second address you have never used. If only the team address gets the email, this is the cause. Move on to step 3.
signs Sign-up or reset works for your own email and fails for a friend's or a new test address, with the error "Email address not authorized."
2. The built-in sender allows 2 emails an hour
Supabase's docs list the built-in sender at 2 messages per hour for the whole project. The docs also say that number can change without notice. Once that allowance is used, more emails in the same hour are blocked.
Supabase's docs also say the built-in sender has no SLA on delivery or uptime, which is one more reason to set up your own for a live site.
signs The first test email arrives, and the next ones in the same hour never do.
3. Set up custom SMTP
Supabase's docs list services that work with its Auth as examples: Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo. Pick one, then verify the domain you send from with it.
Resend example: Resend's docs say you must add and verify at least one domain before you can send. Then create an API key. Resend's SMTP settings are host smtp.resend.com, port 465 or 587, username resend, and the password is your API key. Resend's docs say API keys must be kept confidential, so paste it only into Supabase.
In Supabase, open the Authentication settings page, turn on custom SMTP, and enter the SMTP details, a sender name and a sender address on your verified domain.
Supabase's docs also suggest a separate sending domain for auth emails, such as auth.yourapp.com, and keeping auth emails apart from marketing mail.
signs Custom SMTP is still off in the Authentication settings, or the sender address is on a domain you haven't verified with the service.
4. Raise the rate limit once custom SMTP is on
Supabase's docs say that after you save custom SMTP, the project sends to all addresses, but a limit of 30 messages an hour applies to protect the new sender's reputation.
Open the Rate Limits configuration page and set the email limit to match your sign-ups. Supabase's docs also say to tell your email provider before a big launch, because sudden spikes can hurt sending reputation.
Two other limits are on the same page. Sign-up and sign-in requests allow 30 requests per 5 minutes per IP address by default. Confirmation, magic-link and reset emails wait 60 seconds before the same user can request another.
signs The sign-up or reset screen reports a rate limit, or the request fails with 429 Too Many Requests.
5. The email arrives, but the link is wrong
If the email gets there and the button opens localhost or an old preview address, the problem is the Site URL, not sending. Fix the Site URL and redirect URLs first, using step 1 of Supabase login works locally but fails in production, then test again.
signs The email arrives on time, but its link goes to localhost or an address you no longer use.
Test it like a new user
- Sign up from a private window with an address that is not on your Supabase team.
- Check the confirmation email arrives in the inbox, not in spam.
- Request a password reset, then request another for the same address straight away. Supabase's default is to refuse the second for 60 seconds.
- Open the link in the email and confirm it lands on your live domain.
- In Resend's Domains dashboard, check the sending domain shows as verified.
Common questions
Why does Supabase only send auth emails to me?
Without custom SMTP, Supabase Auth only delivers to addresses on your project's team. Everyone else fails with Email address not authorized. Set up a custom SMTP service such as Resend or Postmark in the Authentication settings, and the project can send to all addresses.
How many emails can Supabase send an hour?
The built-in sender allows 2 messages an hour for the whole project, and Supabase says that can change without notice. After you turn on custom SMTP, the limit starts at 30 an hour. Raise it on the Rate Limits page to match your sign-ups.
Why does the Supabase confirmation email link open localhost?
Sending works, and the Site URL is wrong. Supabase builds the link from the Site URL, which still points at localhost or an old preview. Set it to your live domain under Authentication, then URL Configuration, and add your addresses under Redirect URLs.
Still stuck?
Not sure this is the cause? Paste your app's link into the free scan. It lists what a visitor's browser can see, like leaked keys and exposed files, worst first. The score is free; every fix as a prompt for your builder is $9, one-time.
Want a person to look inside? See the diagnosis