Supabase Auth errorSupabase Auth: user_banned

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why Supabase blocks the user, and the fix

1. 01

   An admin or script set ban_duration

   “User to which the API request relates has a banned_until property which is still active.” Supabase docs, Auth error codes (user_banned)

   A moderation tool, a test script or a dashboard action set a ban. Lift it from a trusted server; the value none clears banned_until.

   const { error } = await supabaseAdmin.auth.admin.updateUserById(userId, {
     ban_duration: 'none',
   });

2. 02

   The ban length was wrong

   ban_duration takes a Go duration such as 1h or 720h. A very large value bans the user for years; another format fails with invalid format for ban duration.

3. 03

   Signed-in users get logged out

   A ban also stops session refresh, so users already signed in fail at the next refresh. Handle user_banned in the error from signIn, refreshSession and getUser calls, and treat an unexpected sign-out as a possible ban.

4. 04

   The app shows a generic sign-in error

   Also check: a banned user who sees “invalid credentials” keeps resetting the password. Map this code to its own message with a support contact.

Checked against the vendor’s docs on November 9, 2026: Supabase docs: Auth error codes; Supabase Auth source: admin.go (ban_duration); Supabase Auth source: tokens/service.go (refresh).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Supabase invalid login credentials · Supabase users logged out (refresh token) · Supabase service role key exposed · Supabase User already registered