Supabase Auth errorSupabase Auth: captcha_failed

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why Supabase rejects the CAPTCHA, and the fix

1. 01

   The token is missing from the auth call

   “CAPTCHA challenge could not be verified with the CAPTCHA provider.” Supabase docs, Auth error codes (captcha_failed)

   Turning on CAPTCHA protection makes every sign-in, sign-up and reset call need a token, including ones in other screens or apps that share the project.

   await supabase.auth.signUp({
     email,
     password,
     options: { captchaToken },
   });
   captcha.current.resetCaptcha();

2. 02

   The same token is used twice

   “We will also need to reset the CAPTCHA challenge after we have made a call to the function above.” Supabase docs, Enable CAPTCHA Protection

   hCaptcha and Turnstile tokens are single-use and expire after a few minutes. A retry after a wrong password, or a double click, sends a used token. Reset the widget after every call and wait for a new one.

3. 03

   The keys don’t match

   “Select your CAPTCHA provider from the dropdown, enter your CAPTCHA Secret key, and click Save.” Supabase docs, Enable CAPTCHA Protection

   The secret key saved in the Dashboard must come from the same hCaptcha or Turnstile site as the site key in the app, and the provider selected must match the widget.

4. 04

   The domain isn’t allowed for the site key

   Also check: a widget on a new domain may not issue valid tokens. Add the domain in the hCaptcha or Turnstile settings for that site key.

Checked against the vendor’s docs on November 9, 2026: Supabase docs: Auth error codes; Supabase docs: Enable CAPTCHA Protection.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Supabase over_request_rate_limit · Supabase signups not allowed · Supabase email rate limit exceeded · Supabase sms_send_failed