By Partly fixable yourself. Needs an email provider account plus Supabase settings.
What you see. New users never get the confirmation email, and Forgot password sends nothing, so nobody can get in.
Why it happens
Supabase ships with a built-in email service meant for testing only. It sends 2 messages per hour per project, and only to pre-authorized addresses, meaning members of your Supabase organization. Everyone else fails with Email address not authorized and never sees the message. Supabase urges every production project to set up a custom SMTP server, meaning your own account with an email provider. Lovable projects on the built-in backend run on the same Supabase engine, so the same limit applies.
A second cause is the link inside the email. Confirmation and reset links send the user to the Site URL or a redirectTo address, and that address must be on the Redirect URLs allow list. If it still points to localhost:3000, the email arrives but the link opens a dead page. A third cause is per-user throttling. Supabase allows one confirmation or reset request per 60 seconds, so rapid retries silently fail.
Fix it yourself
- Open Authentication → Users in Supabase and find the stuck account. A missing confirmed date means the email was never delivered.
- Create an account with a transactional email provider and verify your sending domain there. Copy the SMTP host, port, username, and password.
- In Supabase, open the SMTP Settings page under Authentication, enable custom SMTP, paste the values, and set a sender address on your own domain.
- Open Authentication → Rate Limits and raise the emails per hour limit to fit your expected sign-ups.
- Open Authentication → URL Configuration and set Site URL and Redirect URLs to your live domain so the links in emails open the right page.
- Sign up with a personal address that is not on your team. The email should arrive within a minute.
When to get an engineer
Stop if the Supabase auth logs show the email was sent but it never arrives, which points at domain records such as SPF and DKIM at your email provider, or if the links open but the app shows an error after the click. Give the engineer your email provider, the sending domain, and a screenshot of the auth log. A check is $49–$800, or a single fix €99–$990, within 1–2 days.
Top-rated companies for Supabase apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Check these
Sign-up confirmation and password reset work end to end
Use a real inbox. Check that the link arrives, points to your live domain, and works once.
Sign-in and sign-up are rate limited
Without limits, bots create thousands of accounts and run up your email and AI bills.
Errors reach you before users do
Add error monitoring and uptime alerts. If you learn about outages from customers, this is missing.
Questions
Why did emails work when I tested with my own address?
Your address belongs to the Supabase organization, so the built-in service was allowed to send to it. Anyone outside your team is blocked until you add custom SMTP.
Should I just turn off email confirmation?
Not for a live product. Without it, anyone can register with an address they do not own, and password reset still needs working email. Fix delivery instead.
Sources: Supabase: Send emails with custom SMTP; Supabase: Auth rate limits; Supabase: Password-based auth; Supabase: Redirect URLs.