By Partly fixable yourself. SMTP is a dashboard task, app emails need code.
What you see. Confirmations, password resets, receipts or notifications never arrive, or they only arrive at your own email address.
Why it happens
Your app sends two kinds of email. Auth emails, like confirmations and resets, come from Supabase. App emails, like receipts and invites, come from code the AI wrote. They fail for different reasons.
Supabase's built-in email service is for testing only. It sends at most 2 emails per hour, and until you set up custom SMTP it only delivers to addresses on your own project team. Anyone else gets Email address not authorized. That is why it works for you and nobody else. Once custom SMTP is on, a default limit of 30 emails per hour applies and can be raised under Rate Limits. App emails fail because the AI wrote the send call but never connected a provider, or placed the provider's key in the browser where it is exposed and often rejected. Mail from a domain without SPF, DKIM and DMARC records also lands in spam.
Fix it yourself
- Work out which kind is missing. For auth emails open Supabase Logs, choose Auth, and look for Email address not authorized or a rate limit message.
- Create an account with an email provider. The Supabase docs list Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo. Get the host, port, username and password.
- In Supabase open Authentication, then the SMTP Settings section, enable custom SMTP, and enter those details with a from address on your own domain.
- Add the SPF, DKIM and DMARC records your provider shows you to your domain's DNS. Then send a test to an address outside your team and check spam.
- Before a launch, raise the email limit under Authentication, Rate Limits, since 30 new users per hour is the default.
- For receipts and notifications, have the send call moved to a server function with the provider key in secrets. See also confirmation emails never arrive.
When to get an engineer
Get an engineer for the app emails, because sending from a server function with templates, retries, and a log of what was sent is code work. Tell them which emails you expect, which provider you chose, and whether SMTP for auth is already working. A single fix is €99–$990, about two days. Ask them to confirm sign-up and reset work end to end, check AUTH-01 on the checklist.
Top-rated companies for Supabase apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Check these
Sign-up confirmation and password reset work end to end
Use a real inbox. Check that the link arrives, points to your live domain, and works once.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Errors reach you before users do
Add error monitoring and uptime alerts. If you learn about outages from customers, this is missing.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Questions
Can I launch on the default Supabase email service?
No. It is capped at 2 emails per hour, only reaches your team, and has no delivery guarantee. Supabase says it is for demos and testing.
Do I need a separate provider for app emails and auth emails?
No. One provider can do both. Auth emails go through the SMTP settings, app emails through the provider's API from a server function.
Sources: Supabase: custom SMTP; Supabase: auth rate limits; Supabase: production checklist.