DEV Community

FixLoop
FixLoop

Posted on Originally published at fixloop.dev

Supabase "Email address not authorized": why users never get your signup email

#supabase #auth #lovable #webdev

Sign-up works when you test it. Then real users sign up and the confirmation email never shows up, or supabase.auth.signUp() comes back with Email address not authorized.

Nothing is broken. Your project is still on Supabase's built-in email service, and that service only mails your own team. From the docs: "Unless you configure a custom SMTP server for your project, Supabase Auth will refuse to deliver messages to addresses that are not part of the project's team."

You're on the team, so your test emails arrive. Your users aren't, so theirs don't.

The limits of the default service

  • Team addresses only. "All other addresses will fail with the error message Email address not authorized."
  • A tiny rate limit. "Currently this value is set to 2 messages per hour," and Supabase says it can change without notice.
  • Best effort. It's "not meant for production use."

It applies to every Auth email: confirmations, magic links, one-time codes, invites, email change and password reset.

The fix: bring your own SMTP

  1. Pick a provider. Supabase lists Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo as examples. Anything that speaks SMTP works.
  2. Verify a sending domain with SPF, DKIM and DMARC. Use something like no-reply@auth.yourdomain.com.
  3. Enable custom SMTP in your project's Authentication settings: host, port, user, password, sender email, sender name. Save.
  4. Raise the rate limit. Custom SMTP starts at "a low rate-limit of 30 messages per hour." Bump it on the Auth rate limits page.
  5. Test with an address that isn't on your team. A fresh Gmail works. Check spam too. 
Host:          smtp.yourprovider.com
Port:          587
Username:      from your provider
Password:      SMTP password or API key
Sender email:  no-reply@auth.yourdomain.com
Sender name:   Your App
Enter fullscreen mode Exit fullscreen mode

Don't "fix" it by turning off confirmation

Sign-up will look fine, but password reset still sends email, and on the default service that only reaches your team. Supabase's changelog warns "the forgot password / reset password flow will be broken for your project." It also lets anyone register with an address they don't own.

Still not arriving?

  • Still "not authorized": custom SMTP isn't enabled or didn't save.
  • "Error sending confirmation email": Supabase reached your SMTP server and got refused. The Auth logs show the provider's reply, usually bad credentials or an unverified From domain.
  • Lands in spam: finish SPF/DKIM/DMARC and keep Auth mail plain.
  • Link opens localhost or the preview: that's your Site URL, not SMTP. I covered that in Lovable login works in preview, breaks in production.

Full guide with the checklist and FAQ: fixloop.dev/guides/supabase-email-address-not-authorized. If you're stuck on it right now, paste the error at fixloop.dev/start and we'll email the likely cause within 24 hours, free. (I run FixLoop.)

Top comments (0)