Skip to content
Get a quote

Supabase Auth email errorSupabase “email rate limit exceeded” on sign-up

It worked while you tested. Then real people started signing up, and their confirmation emails never came, or sign-up failed with "email rate limit exceeded". Supabase’s built-in email sender was never meant for that. Here’s the fix, or hand it over at a fixed price.

Short answer

Supabase’s built-in email service is for trying things out. It only sends to members of your project’s team, and Supabase currently limits it to 2 messages an hour, a number it says can change without notice. Set up custom SMTP with an email provider. Supabase then starts you at 30 messages an hour, which you can raise on the Rate Limits page before a launch.

Why emails stop, and the fix

  1. 01

    You’re still on the built-in email sender

    “This server imposes a few important restrictions and is not meant for production use.” Supabase, Send emails with custom SMTP

    Without custom SMTP, Supabase only delivers to addresses on your project’s team. That’s why sign-up worked for you and not for your users. It also stops at 2 messages an hour. Add an SMTP provider under Authentication (Supabase’s guide lists Resend, Postmark and Twilio SendGrid among others), then sign up with a fresh address on the live site.

  2. 02

    Custom SMTP is on, but the limit is still low

    “If you are doing a major public announcement, you will likely require more than this.” Supabase, Production checklist

    Saving custom SMTP settings starts you at 30 messages an hour, to protect your new sender’s reputation. Supabase’s production checklist calls it 30 new users an hour. Raise it on the Rate Limits page in your project’s Auth settings before a launch or an announcement.

  3. 03

    The same person asked twice within a minute

    This one is a per-person limit, not your project running out. Sign-up confirmation, magic link and password reset requests each wait 60 seconds by default before the same user can ask again, and the error reads differently, such as "you can only request this after 60 seconds". You can change that window on the Rate Limits page, and your sign-up form should tell people to wait rather than show the raw error.

  4. 04

    Settings that changed after an update

    A GitHub report (issue 49873, closed as fixed on October 7, 2026) described saving an Auth Hooks change wiping custom SMTP settings and resetting the email limit. Another report (issue 45743, still open) describes hitting the email limit on sign-up despite a Send Email hook. Check the SMTP and Rate Limits pages again after any change to Auth settings.

Checked against the vendor’s docs on : Supabase docs: Send emails with custom SMTP; Supabase docs: Rate limits; Supabase docs: Production checklist; GitHub: Auth Hooks change wiped custom SMTP config (#49873, fixed); GitHub: email rate limit on sign-up despite a Send Email hook (#45743).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Supabase auth emails link to localhost · Supabase security review before launch

Questions

More on this error

Why did it work in testing but not for real users?

Without custom SMTP, Supabase only sends to members of your project’s team. You’re on the team, so your test sign-ups got through. Your users aren’t.

Do I need to change my code?

Usually not. Custom SMTP and the rate limits are settings in your Supabase dashboard. Do check that your sign-up form shows a friendly message when a limit is hit, instead of the raw error.

Can you change these settings for me?

The SMTP and rate limit settings live in your Supabase dashboard, so they stay with you. We can check your sign-up and reset flows, write down the exact settings to enter, and fix any code that sends extra emails, as a pull request you deploy.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes