Short answer
Ask the user to wait a while before trying again, and add a visible countdown on the Resend button so they can’t tap it repeatedly. Use test phone numbers while developing so tests don’t send real SMS, and remove them before launch.
Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
Why Supabase stopped sending SMS, and the fix
01
The same number asked for codes again and again
“Too many SMS messages have been sent to this phone number.” Supabase docs, Auth error codes (over_sms_send_rate_limit)
Tapping Resend several times, or code that calls signInWithOtp more than once per user action, sends a new SMS each time. Add a cooldown on Resend and call it only on a user action.
02
The project’s own SMS cap
“Defaults to 30 SMS messages per hour.” Supabase docs, Rate limits (SMS messages sent by Supabase Auth)
Supabase also lists a project-wide SMS cap, 30 an hour by default and adjustable in the Auth rate limits settings. The docs don’t say which error code that cap returns, so check it when the per-number cause doesn’t fit.
03
Tests send real SMS
“Auth doesn't send an SMS to a test number, and it accepts the fixed code as many times as you need.” Supabase docs, Testing auth flows
Tests against a real phone number send real SMS. Add test phone numbers with a fixed code instead, and remove them before launch, because anyone who knows a test number and its code can sign in as that user.
04
Phone MFA in testing
Also check: test numbers don’t cover phone multi-factor authentication, which always sends a real SMS, so expect MFA tests to send real messages.
Checked against the vendor’s docs on : Supabase docs: Auth error codes; Supabase docs: Rate limits; Supabase docs: Testing auth flows.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start
“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
Related: Supabase SMS send failed · Supabase over_request_rate_limit · Supabase Auth hook_timeout · Supabase email rate limit exceeded