Guide

Supabase signup emails not sending? Why real users never get the confirmation email

The short answer

If you never set up custom SMTP, your app is using Supabase's built-in email sender. Supabase says it is not meant for production:

• It only sends to members of your Supabase organization's team. Anyone else fails with the error Email address not authorized.
• It is rate limited to 2 emails per hour right now, and Supabase says that number can change without notice.
• It has no delivery or uptime guarantee.

So signup works when you test it with your own address, then fails for your first real users. The fix is to connect your own SMTP provider.

How to tell if this is your problem (two minutes)

1. In the Supabase dashboard, open the Authentication settings and look for the SMTP section. If custom SMTP is off, you're on the built-in sender.
2. Sign up in your live app with an address that is not on your Supabase team. If no email arrives, or the auth logs show Email address not authorized, that's the built-in sender's team-only rule.
3. Try a few signups or password resets in a row. Once more than 2 emails go out in an hour, the rest are refused (Supabase Auth returns HTTP 429 when a rate limit is hit).
4. If the email does arrive but the link opens localhost, that's a different setting: the Site URL (see below).

Fix: connect custom SMTP

1. Pick an email service that supports SMTP. Supabase's own docs list Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo as examples.
2. Get the SMTP host, port, username and password from that service, and choose a From address like no-reply@yourdomain.com.
3. In Supabase, go to the Authentication settings, enable custom SMTP and enter those details. Save.
4. After you save, Supabase sends to any address, but starts you at 30 emails per hour to protect your new sender. If you expect more, raise it under Authentication > Rate Limits.
5. With your email service, set up SPF, DKIM and DMARC for the sending domain. Supabase says this greatly improves delivery.
6. Test again with an address outside your team, and check spam.

The other usual cause: links that go to localhost

The Site URL under Authentication > URL Configuration is the default address used in confirmation and password-reset links when your code doesn't pass redirectTo. Supabase's docs tell you to change it from http://localhost:3000 to your production URL. If your app sends users to other pages after login, add those exact URLs to the Redirect URLs allow list. If you use redirectTo, you may need {{ .RedirectTo }} instead of {{ .SiteURL }} in your email templates.

Don't "fix" it by turning off email confirmation

Supabase warns that bots sign up lists of real email addresses to damage your sending reputation or force you to weaken security, and one of its listed goals for attackers is getting you to disable email confirmations. Its advice instead:

• Turn on CAPTCHA protection for signups.
• Prefer social sign-in or one-time codes over email-and-password where it fits.
• Keep auth emails short and plain, and send them from a separate domain or address from your marketing emails.

Why AI builders hit this

Lovable, Bolt, Cursor and similar tools wire Supabase Auth up in minutes, and the first test signup is usually the builder's own email, which is on the Supabase team. Everything looks fine until a stranger signs up.

FAQ

Why do I get my confirmation email but my users don't?

The built-in sender only delivers to your Supabase organization's team members. Set up custom SMTP.

What does "Email address not authorized" mean?

The built-in sender refused an address that isn't on your team.

How many emails can Supabase send for free?

With the built-in sender, currently 2 per hour, and it can change. With custom SMTP the default starts at 30 per hour and you can change it under Rate Limits.

Why does the confirmation link open localhost?

Your Site URL is still http://localhost:3000. Change it to your live URL.

Will MondayMedic catch this?

The free check flags sign-up or login paths that return a server error. It can't read your inbox, so also test with a non-team address yourself.

Sources

• Supabase docs: Send emails with custom SMTP
• Supabase docs: Rate limits
• Supabase docs: Redirect URLs