Guide
Email link is invalid or has expired
A customer clicks the link in a sign-up or password reset email and lands on a page saying the link is invalid or has expired. The same message can appear as a 403 Forbidden response on the verification endpoint, and authentication logs often show an otp_expired error code. This guide applies to apps built with AI app builders that use Supabase Auth for email sign-in.
Why it happens
The token in the link is no longer valid when it is checked. Supabase Auth rejects a token that is invalid, expired or already used, and the error wording covers all of these cases.
Possible causes
- Email prefetching: an email client or security tool opens the link to scan it before the customer does, so the token is already used when the customer clicks.
- The link was opened more than once (for example, the email was passed on to someone else), and magic links are one-time use only.
- The token has passed its validity period; email links expire after a set time, one hour by default.
- A discrepancy between the customer's device system clock and the server's time can make a token appear invalid, though this is less common.
Official fix steps
- Review your email templates and check whether they contain confirmation URLs that might validate or invalidate the token when accessed. (supabase.com)
- Consult your email service provider's documentation for ways to prevent automated prefetching, such as HTML attributes or email headers that tell scanners not to follow links. (supabase.com)
- Consider configuring your system to invalidate the token only after the user explicitly submits it, rather than on first access of a confirmation URL. (supabase.com)
- If you use confirmation URLs, explore a design where the link only sends the user to a page to enter the code, rather than consuming it. (supabase.com)
- Tell users not to forward password reset emails and to click links directly. (supabase.com)
- If prefetching stays a problem, consider an OTP flow where users copy a code from the email into your app instead of clicking a link. (supabase.com)
- Check the Email OTP expiration setting under Authentication, Sign In / Providers, Auth Providers, Email; it also governs the validity of magic links and other email links. (supabase.com)
You can't see it yourself
You're signed in, your customers aren't. You are not opening the link from a new customer's inbox, so you may never meet what they meet. A scanner opening the link or a second click on the same link happens on the customer's side, not in your session.
What to do next
Want it fixed? Our AI agent finds which cause is breaking your app, fixes it in your code and re-checks your live app.
Related: Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44) · AuthApiError: Email not confirmed in Supabase: why new users can't sign in, and how to fix it · New users sign up, then land back on the login page or see an error
Sources
VibeFix's AI agent signs up to your live app like a new person and shows whether sign-up and your pages work. It may not show expired email links directly.
Last checked: 29 October 2026, against the sources listed above.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.
Want it fixed?
Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.
It starts with a free check that confirms the problem on your live app, no account needed.