# Supabase Auth: over_sms_send_rate_limit

> Supabase Auth returns over_sms_send_rate_limit when too many SMS codes went to one phone number. Wait, cap resends in the app, and use test numbers in testing.

Canonical: https://app369.com/fix/supabase-over-sms-send-rate-limit/
Last updated: 2026-11-10

over_sms_send_rate_limit is the Supabase Auth error for too many SMS messages sent to the same phone number. The user has to wait before another code can go out to that number.

**Short answer**

Ask the user to wait a while before trying again, and add a visible countdown on the Resend button so they can’t tap it repeatedly. Use test phone numbers while developing so tests don’t send real SMS, and remove them before launch.

Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

## **Why Supabase stopped sending SMS, and the fix**

1. 01 ### **The same number asked for codes again and again**
  > “Too many SMS messages have been sent to this phone number.” [**Supabase docs, Auth error codes (over_sms_send_rate_limit)**](https://supabase.com/docs/guides/auth/debugging/error-codes) Tapping Resend several times, or code that calls signInWithOtp more than once per user action, sends a new SMS each time. Add a cooldown on Resend and call it only on a user action.
2. 02 ### **The project’s own SMS cap**
  > “Defaults to 30 SMS messages per hour.” [**Supabase docs, Rate limits (SMS messages sent by Supabase Auth)**](https://supabase.com/docs/guides/auth/rate-limits) Supabase also lists a project-wide SMS cap, 30 an hour by default and adjustable in the Auth rate limits settings. The docs don’t say which error code that cap returns, so check it when the per-number cause doesn’t fit.
3. 03 ### **Tests send real SMS**
  > “Auth doesn't send an SMS to a test number, and it accepts the fixed code as many times as you need.” [**Supabase docs, Testing auth flows**](https://supabase.com/docs/guides/auth/testing-auth-flows) Tests against a real phone number send real SMS. Add test phone numbers with a fixed code instead, and remove them before launch, because anyone who knows a test number and its code can sign in as that user.
4. 04 ### **Phone MFA in testing** Also check: test numbers don’t cover phone multi-factor authentication, which always sends a real SMS, so expect MFA tests to send real messages.

Checked against the vendor’s docs on November 10, 2026: [Supabase docs: Auth error codes](https://supabase.com/docs/guides/auth/debugging/error-codes); [Supabase docs: Rate limits](https://supabase.com/docs/guides/auth/rate-limits); [Supabase docs: Testing auth flows](https://supabase.com/docs/guides/auth/testing-auth-flows).

## **Rather hand it over?**

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)

[**All 127 Fiverr reviews**](https://app369.com/reviews/)

Related: [**Supabase SMS send failed**](https://app369.com/fix/supabase-sms-send-failed/) · [**Supabase over_request_rate_limit**](https://app369.com/fix/supabase-auth-over-request-rate-limit/) · [**Supabase Auth hook_timeout**](https://app369.com/fix/supabase-auth-hook-timeout/) · [**Supabase email rate limit exceeded**](https://app369.com/fix/supabase-email-rate-limit-exceeded/)

Questions

## **More on this error**

<details>

<summary>**How long does the user have to wait? **+</summary>

Supabase’s docs give no wait time for this error, only to wait a while. The rate limits page lists a separate limit: a 60 second default window per user for OTP requests.

</details>

<details>

<summary>**Is it the same as sms_send_failed? **+</summary>

No. sms_send_failed means sending the SMS failed, so check the SMS provider configuration; over_sms_send_rate_limit means too many SMS messages went to that phone number.

</details>

<details>

<summary>**Can you fix it for me? **+</summary>

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

</details>

A different error?

## **Describe it and get a written quote**

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.

[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)