# Supabase Auth: otp_disabled (Signups not allowed for otp)
> Supabase returns otp_disabled, often as Signups not allowed for otp, when signInWithOtp has shouldCreateUser false and the email has no account. The fix.
Canonical: https://app369.com/fix/supabase-otp-disabled/
Last updated: 2026-11-09
otp_disabled is the Supabase Auth error code for a magic link or email OTP request that can’t go ahead. In the current Auth server it is returned with the message Signups not allowed for otp when shouldCreateUser is false and no user has that email or phone.
**Short answer**
If the sign-in form is for existing users only, keep shouldCreateUser false and show a neutral message such as “If an account exists, a code is on its way.” If new users should be able to sign up with a code, remove shouldCreateUser: false. Check that the email the user typed matches the one on the account.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why Supabase refuses the code, and the fix**
1. 01 ### **shouldCreateUser is false and the user is new**
> “set this to false if you do not want the user to be automatically signed up” [**Supabase docs, Passwordless email logins (code sample)**](https://supabase.com/docs/guides/auth/auth-email-passwordless) The option stops signInWithOtp from creating accounts. A new email then gets this code instead of a magic link.```
const { error } = await supabase.auth.signInWithOtp({
email,
options: { shouldCreateUser: false },
});
if (error?.code === 'otp_disabled') {
showMessage('If an account exists for this email, a sign-in link is on its way.');
}
```
2. 02 ### **The user typed a different email** A typo, a second address, or a badly formatted email or phone number all look like a missing account; with shouldCreateUser false, the invalid-format case returns this same message. Show the email back on the screen and let the user correct it.
3. 03 ### **The message reveals who has an account** Showing “no account found” lets anyone test which emails are registered. Use the same message for both cases on public forms.
4. 04 ### **Magic links are turned off**
> “Sign in with OTPs (magic link, email OTP) is disabled.” [**Supabase docs, Auth error codes (otp_disabled)**](https://supabase.com/docs/guides/auth/debugging/error-codes) Also check: if the Email provider or magic links are disabled, the current Auth server returns email_provider_disabled for an existing user or when shouldCreateUser is true. A new user with shouldCreateUser false still gets otp_disabled first. The docs describe otp_disabled as OTP sign-in being disabled, so check both settings.
Checked against the vendor’s docs on November 9, 2026: [Supabase docs: Auth error codes](https://supabase.com/docs/guides/auth/debugging/error-codes); [Supabase docs: Passwordless email logins](https://supabase.com/docs/guides/auth/auth-email-passwordless); [Supabase Auth source: otp.go (Signups not allowed for otp)](https://github.com/supabase/auth/blob/master/internal/api/otp.go).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Supabase signups not allowed (signup_disabled)**](https://app369.com/fix/supabase-signups-not-allowed/) · [**Supabase email link invalid or expired**](https://app369.com/fix/supabase-email-link-invalid-or-expired/) · [**Supabase mfa_verification_failed**](https://app369.com/fix/supabase-mfa-verification-failed/) · [**Supabase OAuth provider disabled**](https://app369.com/fix/supabase-oauth-provider-disabled/)
Questions
## **More on this error**
**Is otp_disabled the same as signup_disabled? **+
No. signup_disabled means sign-ups are off for the whole project. otp_disabled here comes from the shouldCreateUser option on one request.
**Does it apply to phone OTP too? **+
Yes. The same check runs for a phone number with shouldCreateUser set to false.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)