Sign-up confirmation emails never arrive (or "email rate limit exceeded")

LovableBoltCursorReplitSupabase Jenny Botby Jenny Bot ·

One error, one plain-English fix you can paste into your AI tool. For apps with email sign-up on Supabase Auth (your own Supabase project, from Lovable, Bolt, Cursor, Replit or any tool), plus a short section for Lovable's built-in backend (Cloud).
Last checked against official docs: 21 Oct 2026.

Symptom

  • New users sign up, but the confirmation email never arrives, so they can't log in. Password reset and magic-link emails don't arrive either.
  • Or sign-up shows an error: email rate limit exceeded (error code over_email_send_rate_limit, HTTP 429) or Email address not authorized.
  • It works when you test with your own email. It fails for real customers, or stops after a couple of test sign-ups.

Why it happens (plain words)

Every Supabase project comes with a built-in email sender. Supabase's docs say it is not meant for production use:

  • It only sends to your own team. Unless you set up your own email service ("custom SMTP"), Supabase Auth "will refuse to deliver messages to addresses that are not part of the project's team" (the members of your Supabase organization). Everyone else gets Email address not authorized. You are on the team, so your own tests work. Your customers aren't, so their emails never go out.
  • It sends very few emails. The built-in sender is currently limited to 2 emails per hour for the whole project, and Supabase says this number "can change without notice". After that, sign-ups fail with email rate limit exceeded.
  • Separate per-user limit. By default Supabase also waits 60 seconds before it sends another confirmation, password-reset or magic-link email to the same user. Clicking "resend" over and over can trigger the rate-limit error too.
  • Even after you fix it there is a limit. When you turn on custom SMTP, Supabase starts you at 30 emails per hour to protect your new sender. You can raise it.

Turning off email confirmation doesn't solve it: password-reset emails still need to be sent, and Supabase warns that without custom SMTP they only reach your team.

How to confirm

  1. Open your live site in a private window and sign up with an address that is not on your Supabase team (a friend's, or a second personal account).
  2. Before you click, open DevTools (Network tab), then submit the form. Click the sign-up request and read the response:
    • email_address_not_authorized / Email address not authorized → you're on the built-in sender (cause 1).
    • over_email_send_rate_limit / email rate limit exceeded → you hit an email limit (cause 2, 3 or 4).
  3. In Supabase, check whether custom SMTP is turned on in the Authentication email settings. Off = this is your problem.
  4. Lovable Cloud apps (no Supabase account of your own): see the Lovable section in the fix below.

Step-by-step fix

  1. Pick an email-sending service that supports SMTP. Supabase lists Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo as examples (any SMTP service works).
  2. Verify your own domain with that service (it gives you DNS records to add, including SPF and DKIM). Choose a From address on that domain, e.g. no-reply@yourapp.com.
  3. Copy the SMTP details from the service: host, port, username, password. Example from Resend's guide: host smtp.resend.com, port 465, username resend, password = your Resend API key.
  4. Supabase → your project → Authentication → Email → SMTP Settings: turn on custom SMTP, fill in sender email, sender name, host, port, username and password, then Save. (If your dashboard menu looks different, look for "SMTP" in the Authentication settings.)
  5. Supabase → Authentication → Rate Limits: raise "Rate limit for sending emails" from the starting 30 per hour to a number that fits your expected sign-ups. Stay within your email service's own plan limits.
  6. Users who already got stuck: they can request a new email once the fix is in. If they hit the 60-second limit, ask them to wait a minute before clicking "resend".
  7. If your app is on Lovable Cloud (Lovable's built-in backend, not your own Supabase project), Supabase SMTP settings don't apply. Lovable's docs say:
    • The hourly cap is "Rate limit for sending emails", under Advanced in More → Cloud → Users → Auth settings → Email. "If your app signs up many users at once and confirmations stop arriving, this limit is the first thing to check."
    • To raise it, first set up email sending for the project (More → Cloud → Emails, with managed email or your own verified domain). Emails are available on paid plans.
    • Ask users to check spam: emails from new domains often land there.
    • A user stuck unconfirmed can sign up again with the same email to get a new confirmation email. You can also add them under More → Cloud → Users → Add user → Create new user (confirmed automatically).

Copy-paste prompt for your AI tool

Sign-up confirmation emails (and password reset emails) are not reaching my users. My app uses [Supabase Auth with my own Supabase project / Lovable Cloud].
1. Find every place my code calls signUp, resend, resetPasswordForEmail, signInWithOtp or similar. Show me how auth errors are handled and make sure the user sees a clear message when there's an error such as "email rate limit exceeded" (code over_email_send_rate_limit) or "Email address not authorized", instead of the app failing silently.
2. Disable the "resend email" button for 60 seconds after each click, so users can't trigger the rate limit by clicking repeatedly.
3. Do NOT turn off email confirmation, and do NOT put any SMTP password or email API key in frontend code or in the repository.
4. Give me a short checklist of what I must change in the dashboard myself: custom SMTP settings (host, port, username, sender email) and the "Rate limit for sending emails" setting.
Explain what you changed in plain English.

How to verify it's fixed

  • In a private window on the live site, sign up with an address that is not on your Supabase team. The email should arrive (check spam too) and come from your own domain.
  • Click the link in the email: it should open your live site and log you in. If it opens localhost or the preview URL, fix your Site URL and Redirect URLs (see our Google login guide, same settings).
  • Try "Forgot password" with the same test account: the reset email arrives.
  • Check that the From address is yours, not Supabase's default.

Safety notes

  • Don't switch off email confirmation to "make the error go away". Supabase's advice is: "Do not disable email confirmations under pressure." Lovable's docs explain why: without confirmation, anyone can sign up with an address they don't own.
  • The SMTP password or API key belongs only in the Supabase (or email service) dashboard. Never in frontend code, VITE_ variables, or the repo. See our exposed-keys guide.
  • Don't raise the email rate limit to a huge number "just in case". Bots that mass-sign-up fake users can wreck your sending reputation. Supabase recommends turning on CAPTCHA protection.
  • Set up SPF, DKIM and DMARC for your sending domain with your email service. It helps your emails reach the inbox instead of spam.

Sources

Educational information only, no warranty. Never paste production secret keys into any tool or chat.

Coming soon

The $9 fix kit

~25 tested fix prompts + checklists (RLS, Stripe, deploy).