Skip to content
Get a quote

Supabase Auth errorSupabase “Invalid login credentials” when users sign in

A user types an email and password and Supabase answers invalid_credentials. Supabase deliberately gives the same answer for several different problems, so the message alone won’t tell you which one it is. Here is each case in Supabase’s words, with the fix, or hand it over at a fixed price.

Short answer

Check error.code. If it is invalid_credentials, Supabase doesn’t say which problem it is: it can mean a wrong password, no account with that email, or an account that only signs in through a social login. Send a password reset if the user has a password account, or point them to the button they signed up with. If the code is email_not_confirmed, it’s a different problem.

Why Supabase says invalid credentials, and the fix

  1. 01

    Wrong password, or no account with that email

    “an error message that will not distinguish between the cases where the account does not exist or that the email/phone and password combination is wrong” Supabase, JavaScript: signInWithPassword

    Supabase returns the same error for a wrong password and for an email with no account, so your app can’t tell which without more checks. We show one neutral message, with a reset link and a sign-up link beside it. The code below is Supabase’s sign-in example; log the error and read error.code.

    const { data, error } = await supabase.auth.signInWithPassword({
  email: 'example@email.com',
  password: 'example-password',
})
if (error) {
  console.error(error)
  return
}

  2. 02

    The account signs in with Google, GitHub or another provider

    “the account can only be accessed via social login” Supabase, JavaScript: signInWithPassword

    A user who signed up with a social button may try the email form later. Supabase counts that as the same error. If your app offers both, put the provider buttons right next to the password form so the user can pick the way they signed up.

  3. 03

    The user forgot the password and there is no reset flow

    “To prevent user enumeration, resetPasswordForEmail() doesn't reveal whether an account exists for the given email address.” Supabase, Password-based Auth

    In our experience, AI-built sign-in forms often ship without a reset link. Supabase’s flow has two steps: a public page that requests the reset email, and a signed-in page that sets the new password. The redirect URL must be in your project’s redirect URLs, and the reset email needs working email sending. Supabase sends no reset email when no account matches the address, so the page can’t confirm the account exists.

    await supabase.auth.resetPasswordForEmail('valid.email@supabase.io', {
  redirectTo: 'http://example.com/account/update-password',
})

await supabase.auth.updateUser({ password: 'new_password' })

  4. 04

    It’s actually a different error code

    “Signing in is not allowed for this user as the email address is not confirmed.” Supabase, Auth error codes

    Read the code, not the message. email_not_confirmed is its own code, for an account whose email was never confirmed, and it needs a different fix from the cases above.

Checked against the vendor’s docs on : Supabase docs: Auth error codes; Supabase docs: signInWithPassword; Supabase docs: Password-based Auth.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Supabase “Email not confirmed” · Supabase email links go to localhost · Sign in with Apple invalid_client · Supabase Email link is invalid or has expired

Questions

More on this error

Every user gets this error after we moved the app. Why?

In our experience this usually means the app now talks to a different Supabase project from the one where the accounts were created, for example after moving off a builder’s hosted backend. Check the project URL your app uses against the project that holds the users.

Should the error say whether the email exists?

For sign-in, Supabase says its error doesn’t distinguish the cases, and its reset method doesn’t reveal whether an account exists. We also keep our own messages neutral and offer reset and sign-up links beside them.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes