Short answer
With Confirm Email off, signUp() with an email that already has an account returns User already registered. With it on, which is the default on hosted projects, Supabase hides that the account exists and returns what looks like a new user, with an empty identities list. Handle both: tell people to sign in or reset their password, without saying whether the email has an account.
Why it happens, and what to show people
01
Confirm Email is off, so Supabase says the email is taken
“User with this information (email address, phone number) cannot be created again as it already exists.” Supabase, Auth error codes
Supabase Auth’s open-source code returns this error only when the project confirms emails automatically. Then a second sign-up with the same email gets this error straight away. Catch error.code user_already_exists and send people to sign-in or password reset.
02
Confirm Email is on, so there is no error
“Be aware that if a user account exists in the system you may get back an error message that attempts to hide this information from the user.” Supabase, signUp
With confirmations on, Supabase doesn’t reveal that the account exists, so people can’t use your sign-up form to find out who has an account. For an account that is already confirmed, signUp() succeeds, but the returned user has an empty identities list and nothing else happens.
03
Your app treats every sign-up as new
If the app saves the returned user ID or creates a profile row from it, the hidden case gives it an ID that matches no real user. Create profiles in a trigger on auth.users, or after the user confirms, not from the sign-up response.
04
Dev and production behave differently
“On hosted Supabase projects, this is true by default. On self-hosted projects or in local development, this is false by default.” Supabase, Password-based Auth
The error can show up locally and not on the hosted project, because the Confirm Email default differs. Our Email not confirmed page covers that setting.
Checked against the vendor’s docs on : Supabase docs: Auth error codes; Supabase reference: signUp; Supabase docs: Password-based Auth.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.See scope and start
Related: Supabase Email not confirmed · Supabase Invalid login credentials · Supabase Database error saving new user · Supabase Signups not allowed for this instance