AI & TechnologySupabase Auth Errors: 11 Sign-In and Email Fixes (2026)

Short answer: most Supabase Auth problems come from four places: the error Supabase deliberately keeps vague at sign-in, the built-in email service and its limits, email links that are used up or point to the wrong address, and sessions that two parts of the app refresh at once. Find your error below; each one links to a full fix page that quotes Supabase’s documentation.

Supabase Auth errors usually look like broken code but come from a project setting, an email limit or how the session is stored. The 11 errors below are the ones that stop users from signing up or signing in on apps built with Supabase, including apps generated by Lovable, Bolt and other AI builders. Each fact comes from Supabase’s own documentation, quoted on the linked fix page, and the order of checks is App369’s advice.

Sign-in fails with an error message

Supabase returns “Invalid login credentials” for three different problems. According to the Supabase signInWithPassword reference, the error “will not distinguish between the cases where the account does not exist or that the email/phone and password combination is wrong”, and it also covers accounts that can only be accessed via social login.

“Invalid login credentials”

Check error.code first. If it is invalid_credentials, the user may have the wrong password, no account under that email, or an account created with Google or Apple. Send a password reset, or point them to the sign-in button they used. Full steps: Supabase “Invalid login credentials”.

“Email not confirmed”

Confirm Email is on by default for hosted Supabase projects, so a user who never clicked the confirmation link can’t sign in. If the email never arrived, the problem is sending, not sign-in (see the email section below). Resend it with supabase.auth.resend(). Full steps: Supabase “Email not confirmed”.

“provider_disabled”

The sign-in provider is off for this project. Supabase’s error codes page describes it as “OAuth provider is disabled for use.” Turn the provider on in the dashboard with its client ID and secret; for local development, configure it in supabase/config.toml. Full steps: Supabase provider_disabled.

Sign in with Apple returns “invalid_client”

Apple couldn’t match the client ID, or the client secret has expired. On the web, the client ID must be your Services ID, listed first in Supabase. Apple also requires a new secret key every 6 months, generated from your .p8 signing key, according to Supabase’s Apple guide. Full steps: Sign in with Apple invalid_client.

Sign-up and auth emails don’t arrive or don’t work

Supabase’s built-in email service has a rate limit of 2 emails per hour, on a best-effort basis, according to Supabase’s password auth guide. Supabase’s SMTP guide says it “is not meant for production use”, so every launched app needs its own email provider.

“Email rate limit exceeded”

The built-in service only sends to members of your project’s team, and only a few messages an hour. Set up custom SMTP with an email provider; Supabase then starts you at 30 messages an hour, which you can raise on the Rate Limits page before a launch. Full steps: Supabase email rate limit exceeded.

Sign-up emails go to spam

Send from your own domain through custom SMTP, and set up SPF, DKIM and DMARC with your email provider. Supabase notes that a custom domain reduces the chance of being marked as spam because of another Supabase project’s bad reputation. Full steps: Supabase emails going to spam.

Email links open localhost:3000

The Site URL is still the default. Supabase redirects to the Site URL whenever your code doesn’t pass a redirect URL, and that “defaults to localhost:3000”. Change it under Authentication, URL Configuration, and put any redirect URL your code passes on the Redirect URLs allow list. Full steps: Supabase email links to localhost.

“Email link is invalid or has expired”

The link was used before the user clicked it. Supabase’s troubleshooting guide names the most common cause as email prefetching: a mail client or security tool opens the link to scan it and uses up the one-time token. Put the 6-digit code {{ .Token }} in the email template, or link to your own page where the user enters it. Full steps: Supabase otp_expired.

Users get logged out

Supabase access tokens are short-lived, usually between 5 minutes and 1 hour, and each refresh token can be used only once, according to Supabase’s sessions guide. Most surprise logouts come from where the session is stored or from two parts of the app refreshing it.

Logged out after a page refresh

In Next.js and other server-rendered apps, use the @supabase/ssr clients so the session lives in cookies, and add the middleware that refreshes it on every request. In a browser-only app, create one client with persistSession on, and wait for the stored session before a route guard sends anyone to the login page. Full steps: Supabase session lost on refresh.

“Invalid Refresh Token”

Reusing a refresh token outside the short reuse window makes Supabase treat “the whole session” as terminated and revoke its refresh tokens. Look for two places refreshing with the same token, such as the server and the browser, or an app restoring an old saved session. Full steps: Supabase Invalid Refresh Token.

Sign-up fails with “Database error saving new user”

Supabase’s troubleshooting guide lists three common causes: a failing trigger or function on auth.users, a constraint on that table that isn’t met, and Prisma breaking the table’s permissions. A frequent example is a handle_new_user trigger that inserts into a profiles table that doesn’t exist. Open the Auth logs, then the Postgres logs, for the exact error. Full steps: Database error saving new user.

Which to check first

Check the exact error code first, then the Site URL, then how email is sent. App369’s full order for a Supabase app where sign-up or sign-in just broke:

1. Read the exact error code in the browser console or the Auth logs; most of the errors above have a distinct code.
2. Check the Site URL and Redirect URLs under Authentication, URL Configuration.
3. Check whether email is going through custom SMTP or the built-in service.
4. Try the flow on the live domain in a private window, with a new email address.
5. If users are logged out at random, search the code for more than one place that creates a Supabase client or refreshes the session.

The Supabase errors and fixes page lists every Supabase fix, including row level security and database errors. Before launch, the Supabase security review covers the settings to check beyond Auth. For database, Realtime and Edge Function errors, see the Supabase database and Edge Function errors guide.

Need a hand?

App369 fixes single sign-in bugs at a fixed price. If one bug is the whole problem, the App Fix Ticket covers it in two fixed-price steps: a $450 diagnosis that finds the root cause and gives you a fixed quote for the fix, then the fix itself. If the app was built with an AI builder and more is going on, the AI-Built App Rescue starts with a Launch Check of the whole app. Or describe the problem and get a written quote.