Log inStart free

Not receiving Auth emails

Confirmation, magic link or password reset emails don't arrive. A checklist to find out whether Auth sent the email, and what blocks it on the way, including rate limits and spam filters.

What you see

A user signs up, asks for a magic link or resets their password, and no email arrives. Sometimes the request fails with a 429 instead:

AuthApiError: email rate limit exceeded
AuthApiError: For security purposes, you can only request this after 60 seconds.

Both carry error_code: "over_email_send_rate_limit".

Why it happens

The email either was never sent (Auth decided not to send it, or the request failed), or it was sent and got filtered or delayed on the way. Work out which one first.

How to fix it

  1. Check whether Auth tried to send it. In Studio's SQL editor:

    select email, created_at, confirmation_sent_at, recovery_sent_at, email_confirmed_at
from auth.users
where email = '[email protected]';
    • No row: the sign-up never reached Auth. Check the error your client got, and whether Disable new sign-ups is on.
    • email_confirmed_at set, confirmation_sent_at empty: Skip email confirmation is on, so no confirmation email is sent. That's expected.
    • A recent *_sent_at time: Auth handed the email over for delivery. Go to step 5.

  2. Check for an existing account. If the address already belongs to a confirmed user, signUp() returns what looks like success (a user whose identities array is empty) and sends nothing, so it doesn't reveal which addresses are registered. Send these users to "forgot password" or a magic link instead.

  3. Respect the cooldowns. Auth sends at most one email to the same address per 60 seconds, and each project has a limit on Auth emails over time. A resend button pressed twice, or a test script in a loop, hits both. Disable the button after a click and show the 429 message to the user.

  4. Check the toggles. Dashboard → your project → Auth tab → Sign-in & security: Email sign-in must be on for email and password, magic links and codes.

  5. Look at delivery. Ask the user to check spam, promotions and any company quarantine. Auth emails come from [email protected], with your App name as the sender name. Company mail filters sometimes hold new senders; ask their IT team to allow that address. Also check the address for typos (gmial.com is common).

  6. Test with an inbox you control. Use a personal Gmail or Outlook address. If those receive emails but one company domain doesn't, the problem is that domain's filtering.

On SupaHost

  • SupaHost sends Auth emails for every project through its own email provider. Custom SMTP isn't available, so there's no SMTP setting to check, and you can't raise the email send limit.
  • Set the sender name with App name on the Auth tab (Auth card, then Save Auth settings), and edit the wording under Auth emails.
  • If an address or domain consistently doesn't get emails that Auth marked as sent, email [email protected] with the project name, the address and the times you tried.
  • If you need emails from your own domain or provider, you can generate the links yourself on the server and send them with your own provider. See Sending Auth emails in the user's language.

Updated 11 November 2026 · View as Markdown · Something wrong or missing? Tell us