UnbreakMyApp / Fix guides

Supabase sign-up or password-reset emails not arriving, or links go to the wrong URL

Users never get confirmation or magic-link emails, or the link opens localhost. Why Supabase's default email server causes it and how to fix it.

Why it happens

Every Supabase project starts with a built-in email server meant only for testing. Supabase documents that it only sends to addresses on your project's team, with a very low rate limit (currently 2 messages per hour, and it can change). Real users get nothing, or see "Email address not authorized".

The fix for production is a custom SMTP provider (Supabase lists options like Resend, Postmark, AWS SES, SendGrid and Brevo). After you add it, Supabase starts at 30 messages per hour, which you can raise under Rate Limits.

If emails arrive but the link opens localhost:3000 or the wrong site, your Site URL or Redirect URLs in Authentication → URL Configuration are still set to the development address, or the redirect URL your app passes is not on the allow list.

How to fix it, step by step

1. Check Supabase → Authentication → Logs for errors like "Email address not authorized" or rate-limit messages.
2. Sign up for an email provider that supports SMTP, verify your sending domain, and add the DKIM/SPF records they give you.
3. In Supabase → Authentication → Emails → SMTP Settings, enable custom SMTP and enter the host, port, username, password and a From address like no-reply@yourdomain.com.
4. Raise the email rate limit under Authentication → Rate Limits if 30 per hour is too low.
5. In Authentication → URL Configuration, set Site URL to your live domain (e.g., https://www.yourapp.com) and add every domain you use to Redirect URLs (live, www, and your preview domain).
6. In your code, pass the right redirect when signing up or resetting: emailRedirectTo / redirectTo should be your live URL, not localhost.
7. Test with a fresh email address and check spam.

Paste-ready prompt for Lovable

Auth emails are not arriving / links go to the wrong URL. Please:
1. Find every supabase.auth call that sends email (signUp, signInWithOtp, resetPasswordForEmail, etc.).
2. Make sure each passes emailRedirectTo / redirectTo using window.location.origin plus the right path (e.g., /auth/callback or /reset-password), not a hardcoded localhost URL.
3. Make sure the page those links open exists and handles the session correctly.
4. Give me a checklist of what to set in Supabase: Site URL, Redirect URLs (list the exact URLs), and custom SMTP settings.
Do not change anything else.

FAQ

Sources

• https://supabase.com/docs/guides/auth/auth-smtp
• https://supabase.com/docs/guides/auth/redirect-urls
• https://resend.com/pricing