VVibeFix

Guide

Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44)

Updated

Short answer: Supabase confirmation email not sending is usually the default sender: Supabase says it only delivers to your project's team, sends 2 messages an hour and is not meant for production. The standard fix is your own sender (custom SMTP) under Authentication settings, then a higher email limit on the Rate Limits page.

Get it fixed: a free check first confirms the problem on your live app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Want it fixed? Our AI agent fixes it in your code and tests your live app again. See pricing.

Login, emails or payments broke in your live app? Our AI agent fixes it in your code, then tests your live app again.

In our checks of 44 live AI-built apps, almost 1 in 4 (10 of 44) had a sign-up, login or verification-email problem that stopped a new person getting in.

Something broke on your live app? Tell us what broke. Our AI agent tries it on your live app and sends you a screenshot, free. Check my app free

What we add from real checks: the addresses the owner tries are on the project's team, so the email arrives for them. The first new customer, signing up on the live address, is the first one who gets nothing.

Lovable and Base44 apps send through their own services, with their own limits, covered below. Lovable projects on the built-in backend manage email authentication settings in Lovable instead of in Supabase.

Why do new users never get the confirmation email?

The default senders are made for trying things out, not for strangers arriving from an ad or a post. Sign-up only finishes when the person clicks the link or enters the code in that email, so whatever sends your app's emails decides who gets them, how many go out per hour and whether they land in the inbox.

What causes the confirmation email not to arrive, and how do I fix each one?

The default sender, an hourly limit, a failed hand-over or spam filtering, and the Lovable and Base44 senders each stop the email in a different way.

Why does Supabase's default sender only deliver to my team?

Unless you set up your own SMTP server, Supabase only sends to addresses that are part of the project's team. Everyone else's message fails (the error code is email_address_not_authorized). Every address you test with is on the team; a new customer's is not.

How to fix it

  1. From your email provider, get the SMTP server host, port, user and password, and choose a From address on your own domain (for example no-reply@yourdomain.com).
  2. In the Supabase dashboard, open the Authentication settings page and enable custom SMTP.
  3. Enter the host, port, user, password and From address, and save.
  4. Sign up with an address that is not on your team and confirm the email arrives.

Source: Supabase: Send emails with custom SMTP · Supabase: Auth error codes

Did I reach the hourly email limit?

Probably, if a few people signed up close together or on a launch day: the default service sends 2 messages per hour for the whole project, and once custom SMTP is saved, Supabase starts you at 30 messages per hour, so later people get nothing once that is used up.

How to fix it

  1. Set up custom SMTP first (the first cause above). Supabase says the email limit can be configured once you use custom SMTP or a Send Email hook.
  2. Open Authentication, Rate Limits in the dashboard.
  3. Raise the email limit to fit the sign-ups you expect, within what your email provider allows.

Source: Supabase: Send emails with custom SMTP · Supabase: Rate limits

Why does mail from my own sender fail the hand-over or land in spam?

A wrong setting stops Supabase handing the message to your provider, and after the hand-over Supabase says it "has no control over email delivery". Providers keep suppression lists of addresses that bounced before, and recipients' mail filters can quarantine or spam the message.

How to fix it

  1. Check your project's Auth logs first; a failed hand-over shows there.
  2. Then check your email provider's own logs for blocked or suppressed addresses.
  3. With your provider, set up DKIM, DMARC and SPF for the sending domain.
  4. Send from your own domain, and keep sign-in emails separate from marketing emails (a separate sending domain or From address).
  5. Ask the person who is not receiving mail to check with their email server admin whether your email domain is blocked or quarantined.

Source: Supabase troubleshooting: Not receiving Auth emails from the Supabase project · Supabase: Send emails with custom SMTP

Is the Lovable project's hourly email cap stopping my confirmations?

Possibly, if many people signed up: Lovable apps on Lovable's built-in backend have a per-project "Rate limit for sending emails" that caps sign-in emails per hour, and Lovable says it is the first thing to check when confirmations stop arriving after many sign-ups. Lovable's Emails feature also limits how many authentication emails a workspace sends per hour (Pro 500, Business 3,000, Enterprise 10,000), and at a workspace limit Lovable rejects new emails until the hour resets.

How to fix it

  1. Open More, Users, Settings, Email, and look under Advanced for "Rate limit for sending emails".
  2. Raise it to match your expected sign-ups. Lovable notes that raising the sending limit needs managed email or a verified custom domain first.
  3. Open More, Emails to see the workspace usage; Lovable shows a warning at 80% of a limit. For a higher workspace limit, contact Lovable Support.

Source: Lovable: Email authentication for your app · Lovable: Send branded emails from your own domain

App broke after you published it? Our AI agent fixes it in your code, then tests your live app again so you see the result yourself. The first check is free. Check my app free

Why do Lovable emails from a new domain land in spam?

Lovable says emails from new domains often land in spam. On a paid workspace you can send sign-in emails from your own domain, with Lovable handling the DNS, SPF, DKIM and DMARC.

How to fix it

  1. Ask people who are waiting to check their spam folder first.
  2. Open More, Emails and click Get started (a paid workspace, a domain you own and access to its DNS are required).
  3. Enter your domain and keep or change the sender subdomain (Lovable creates notify by default), then click Set up domain.
  4. Add the records Lovable shows. Add the NS records inside your DNS zone for the subdomain host shown; do not replace your domain's nameservers at your registrar.
  5. Wait for the status to show Verified (usually a few hours, up to 72), then send a test sign-up.

Source: Lovable: Email authentication for your app · Lovable: Send branded emails from your own domain

Why does the Base44 6-digit code never arrive?

Base44 sends a 6-digit code that works for 10 minutes, from no-reply@base44-apps.com unless you set up your own email domain. Email verification cannot be turned off, so a person without the code cannot log in with their password.

How to fix it

  1. Ask the person to check spam or junk, wait a few minutes, add no-reply@base44-apps.com to their safe senders and check the address for typos.
  2. They can ask for a new code from the verification screen, or sign up again with the same address.
  3. If it still fails, remove their record from the Users list in your dashboard and ask them to sign up again. If several people report it at once, contact Base44 Customer Care with your app URL and the affected addresses.
  4. To send from your own domain (Starter plan or above, with a domain connected): Dashboard, Domains, Email domain, Use Your Custom Domain. Add the 3 CNAME records Base44 shows and wait for the status to be Active (up to 48 hours).

Source: Base44: Managing login and registration · Base44: Sending emails from a custom domain

What if the person missed the first email and cannot get another?

They are left with an unconfirmed account, for example after deleting the email or typing a wrong address, and in Lovable signing in again does not resend the email.

How to fix it

Get it fixed: a free check first confirms the problem on your live app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Want it fixed? Our AI agent fixes it in your code and tests your live app again. See pricing.

  1. Supabase: give the app a "resend email" button that calls supabase.auth.resend with type signup and the person's address.
  2. Lovable: the person signs up again with the same address. You can also add them yourself under More, Users, Add user, Create new user; users added this way are confirmed automatically.

Source: Supabase JavaScript reference: resend() · Lovable: Email authentication for your app

Why does the confirmation email work in preview but not after publishing?

The addresses you try in preview are on your project's team and you send only a few emails, while real customers on the published app are neither. Without custom SMTP, Supabase Auth refuses to deliver messages to addresses that are not part of the project's team, so the first stranger who signs up gets nothing, and delivery problems after the hand-over sit with the email provider.

This applies to apps connected to your own Supabase project, because those projects manage authentication in Supabase. Lovable projects on the built-in backend manage email authentication settings in Lovable instead (see the Lovable cause above).

How to fix it

  1. Check your project's Auth logs for errors when the email is handed to the provider.
  2. Set up custom SMTP on the Authentication settings page and choose a From address such as no-reply@example.com.
  3. After saving, adjust the low default rate limit on the Rate Limits page to fit your sign-ups.
  4. If delivery still fails, check the email provider's logs for blocks or a suppression list, and ask the person to check with their email server admin whether your domain is blocked or quarantined.

Source: Supabase troubleshooting: Not receiving Auth emails from the Supabase project · Supabase: Send emails with custom SMTP · Lovable: Email authentication for your app

Why are Supabase magic link emails not delivered?

Magic links go out through the same Auth email sender as confirmation emails, so the same causes apply: the default sender only delivers to your project's team, is capped at 2 messages an hour and can end up in spam. A customer asks for a magic link and nothing arrives, while a team address works fine.

Magic links also have their own limits. By default a user can only request one every 60 seconds, a link can be used once, and it expires after 1 hour.

How to fix it

  1. Check your project's Auth logs, then your custom SMTP provider's logs, since hand-over errors can come from a wrong setting.
  2. Set up custom SMTP (host, port, user, password and a From address), so your project sends to all addresses.
  3. Adjust the low rate limit of 30 messages per hour on the Rate Limits page to suit your use case.
  4. In your app, disable the "send link" button for 60 seconds after each request, and tell the person to use the newest link within the hour.
  5. Ask the person to check spam, and to ask their email server admin whether your domain is blocked or quarantined.

Source: Supabase: Passwordless email logins (magic link) · Supabase: Email OTP and magic links · Supabase: Rate limits · Supabase: Send emails with custom SMTP

How do I check it's fixed?

  1. Open your live app in a private window and sign up as a new user with a fresh address that is not on your project's team (a new free mailbox works).
  2. The email arrives in the inbox, not spam, within a few minutes.
  3. Its link opens your live address, not localhost or the preview, and the account is confirmed.
  4. The project's Auth logs show the email sent with no error.

Why does my own sign-up prove nothing?

Your address is on the team, so you never reach the hourly limit, and your mail provider knows you. Test with a new address. If the email arrives but its link opens localhost, that is a different setting: see the confirmation link opens localhost.

Frequently asked questions

Why is Supabase not sending confirmation emails?

Most often because the project still uses the default email service, which only delivers to addresses on the project's team and sends 2 messages an hour. Set up custom SMTP under Authentication settings, then check the Auth logs if emails still do not arrive.

Why does the confirmation email arrive for me but not for new users on my live app?

The addresses you try yourself are on the project's team, so the email arrives for you. The first new customer, signing up on the live address, is the first one who gets nothing, because Supabase's default sender only delivers to team addresses. Set up your own sender (custom SMTP) and test with an address that is not on your team.

How many emails can Supabase send per hour?

The default service sends 2 per hour. After you set up custom SMTP, Supabase starts at 30 per hour, which you can change on the Rate Limits page. Your email provider may have its own limits.

How do I resend the Supabase confirmation email?

Call supabase.auth.resend with type signup and the person's email address, for example from a "resend email" button on your sign-in page.

Why do my Lovable confirmation emails go to spam?

Lovable says emails from new domains often land in spam. You can send from your own domain under More, Emails, and Lovable's deliverability advice is to let volume grow gradually and send only emails triggered by something the person did.

Can I turn off email confirmation?

In Supabase, Confirm email is a setting, and Supabase says it is on by default for hosted projects. Lovable has an Auto-confirm email switch. Base44 does not let you turn verification off. Without confirmation, people get in without proving the address is theirs.

Can VibeFix fix it for me?

Yes, if you ask. The free check confirms the problem first. Our AI agent can find the cause, fix it in your code and test your live app again. The price is on the pricing page.

Sources (official documentation)

Related guides

Related: Supabase "email rate limit exceeded" checker

VibeFix is independent. Supabase, Lovable, Bolt and Base44 are trademarks of their owners.

Fixed it? Prove it works on your live app

A fix that works from your own account proves nothing about a new customer. Your AI fixed it. VibeFix proves it works on the live site.

How it works. Start with a free check: our AI agent tries your live app like a new user and shows you what breaks. Then, on request, it reviews your code independently, because VibeFix isn't part of any app builder. It fixes it in your code and re-checks your live app. The free check signs up once as "VibeFix Test" with its own inbox, needs no account, never changes your app and never emails your users.

Check my app free

Want it fixed?

Our AI agent fixes it in your code and tests your live app again. See pricing.

It starts with a free check that confirms the problem on your live app, no account needed.

Check my app free

Related guides

More guides