# Supabase Auth: user_banned
> Supabase returns user_banned while the user’s banned_until date is in the future. Lift the ban with ban_duration none, or show a blocked-account message.
Canonical: https://app369.com/fix/supabase-user-banned/
Last updated: 2026-11-09
user_banned is the Supabase Auth error code for a user whose banned_until date has not passed yet. The Auth server returns it as User is banned on password sign-in, and as Invalid Refresh Token: User Banned when a session refreshes.
**Short answer**
To unban, call auth.admin.updateUserById from a server with the service role key and set ban_duration to none. To ban on purpose, set a duration such as 24h, and show users a clear message for this code instead of a sign-in error. Check that no admin tool or script set the ban by mistake.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why Supabase blocks the user, and the fix**
1. 01 ### **An admin or script set ban_duration**
> “User to which the API request relates has a banned_until property which is still active.” [**Supabase docs, Auth error codes (user_banned)**](https://supabase.com/docs/guides/auth/debugging/error-codes) A moderation tool, a test script or a dashboard action set a ban. Lift it from a trusted server; the value none clears banned_until.```
const { error } = await supabaseAdmin.auth.admin.updateUserById(userId, {
ban_duration: 'none',
});
```
2. 02 ### **The ban length was wrong** ban_duration takes a Go duration such as 1h or 720h. A very large value bans the user for years; another format fails with invalid format for ban duration.
3. 03 ### **Signed-in users get logged out** A ban also stops session refresh, so users already signed in fail at the next refresh. Handle user_banned in the error from signIn, refreshSession and getUser calls, and treat an unexpected sign-out as a possible ban.
4. 04 ### **The app shows a generic sign-in error** Also check: a banned user who sees “invalid credentials” keeps resetting the password. Map this code to its own message with a support contact.
Checked against the vendor’s docs on November 9, 2026: [Supabase docs: Auth error codes](https://supabase.com/docs/guides/auth/debugging/error-codes); [Supabase Auth source: admin.go (ban_duration)](https://github.com/supabase/auth/blob/master/internal/api/admin.go); [Supabase Auth source: tokens/service.go (refresh)](https://github.com/supabase/auth/blob/master/internal/tokens/service.go).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Supabase invalid login credentials**](https://app369.com/fix/supabase-invalid-login-credentials/) · [**Supabase users logged out (refresh token)**](https://app369.com/fix/supabase-users-logged-out-refresh-token/) · [**Supabase service role key exposed**](https://app369.com/fix/supabase-service-role-key-exposed/) · [**Supabase User already registered**](https://app369.com/fix/supabase-user-already-registered/)
Questions
## **More on this error**
**Does a ban end on its own? **+
Yes. The user is banned only while banned_until is in the future; after that date, sign-in works again.
**Can the app lift a ban from the browser? **+
No. Admin methods need the service role key, which must stay on a server or in an Edge Function.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)