Blog ·

Users not getting confirmation emails? Fix your Supabase email settings

You built your app with Lovable, Bolt, Cursor or Replit, connected it to Supabase for login, and tested sign-up yourself. The confirmation email arrived. Then you launched, real people signed up, and the email never came. They can't confirm their address, so they can't log in, and most of them won't tell you.

The short answer

If your app uses your own Supabase project and you never set up custom SMTP, Supabase is still sending your login emails with its built-in email service. According to Supabase's docs, that service:

  • only delivers to email addresses that are members of your Supabase organization's team. Everyone else fails with the error "Email address not authorized"
  • is limited to 2 emails per hour, a limit Supabase says can change without notice
  • is best effort only, with no SLA, and is not meant for production

That is why it worked when you tested it: your address is on the team. A stranger's isn't.

How to check this is your problem

  1. In your Supabase project, open the Auth logs and look around the time a user signed up. Supabase recommends the Auth logs as the first place to look when auth emails don't arrive.
  2. Look for email_address_not_authorized. Supabase's error code list says this means your project is using the default SMTP service, which can only send to members of your organization.
  3. Also look for over_email_send_rate_limit. That means too many emails were sent and the user has to wait before trying again.
  4. Sign up with an address that is not on your Supabase team, such as a personal Gmail account. If your own address gets the email and that one doesn't, it's the built-in sender.

The fix: connect your own email provider

Supabase Auth works with any email service that supports SMTP. Its docs list Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo. Here is the setup with Resend, following Resend's own guide:

  1. In Resend, verify a domain you own and create an API key.
  2. In your Supabase project, click Authentication in the left sidebar, then Email under Notifications, then SMTP Settings, and enable custom SMTP.
  3. Enter host smtp.resend.com, port 465, username resend, and your Resend API key as the password.
  4. Add a sender email and sender name, for example no-reply@yourdomain.com and your app's name. Both are required.
  5. Save. From then on, Supabase sends your sign-up, password reset and magic link emails through Resend.

Treat the API key like a password: it belongs in the Supabase SMTP settings, not in your app's code.

Then check the email rate limit

Once custom SMTP is saved, Supabase starts you on a low limit of 30 emails per hour to protect your new sender's reputation. If you expect more sign-ups than that, raise it under Authentication, then Rate Limits, in your Supabase project.

Help the emails reach the inbox

  • Set up SPF, DKIM and DMARC for your sending domain with your email provider. Supabase says this significantly improves deliverability.
  • Keep login emails short and plain. Supabase advises against marketing content, taglines and lots of links in authentication emails, because spam filters may treat them as marketing.
  • If an email still doesn't arrive, check your email provider's logs next. Supabase notes that once a message is handed over, delivery is out of its hands, and providers can block addresses that previously bounced.

Using Lovable Cloud instead of your own Supabase project?

If your Lovable app uses Lovable's built-in backend, Lovable sends the login emails and the Supabase steps above don't apply. Lovable's docs suggest:

  1. Ask users to check their spam folder first, since emails from new domains often land there.
  2. If many people signed up at once, check "Rate limit for sending emails" under Advanced in the email settings (More, then Users, then Settings, then Email).
  3. To raise that limit and improve deliverability, set up sending from your own domain under More, then Emails. Lovable's docs say this is available on paid plans.
  4. A user stuck unconfirmed can sign up again with the same email address to get a new confirmation email. Signing in again does not resend it.

Don't just switch off email confirmation

Turning off confirmation makes the symptom go away, but Lovable's docs point out that without it anyone can sign up with an address they don't own, and Supabase's docs advise against disabling email confirmations under pressure. Password reset emails also still need a working sender.

Catch silent breaks before your users do

A sign-up that says "check your email" and then goes quiet looks fine from the outside. FlowCanary's scheduled monitoring is launching by 30 November 2026. Once it is live, it will test your sign-up, login and checkout in a real browser on a schedule and send you a plain-English alert plus a fix prompt for Lovable, Bolt, Cursor or Replit when something breaks. Until then, you can run a free check on your app today.

Sources (checked 21 October 2026)

Run the free checker