Guide
Supabase sign-up error: "email rate limit exceeded"
Updated
Supabase Auth returns a 429 error with the code over_email_send_rate_limit and the message email rate limit exceeded when the project reaches its email sending limit. This applies to apps that use Supabase Auth as their backend, including apps made with AI app builders. The official fix is to set up custom SMTP or the Send Email hook, then change the email limit in Authentication > Rate Limits.
Fixed in your code, then tested live. Check my app free
Why it happens
Supabase Auth enforces rate limits on authentication endpoints to prevent abuse, and the emails-sent limit applies to all email-sending Auth endpoints. With the built-in email provider the limit is currently 2 emails per hour across the whole project, and the docs say it can change without notice.
Possible causes
- The project is still on the built-in email provider, which sends 2 emails per hour across the whole project while Confirm email is on.
- Custom SMTP was set up recently, and the email limit that starts at 30 messages per hour is lower than the number of emails your sign-ups and sign-ins need.
- Bots or attackers are signing up users with lists of known email addresses. The docs say this kind of abuse can prevent new account creation.
Official fix steps
- Set up a custom SMTP server or the Send Email hook so your project can send to any address and raise the limit. (supabase.com)
- Choose an email sending service, create an account, and get its SMTP host, port, user, password and a default From address. (supabase.com)
- Go to the Authentication settings page and enable and configure custom SMTP with those details. (supabase.com)
- After saving, adjust the email limit to a value that fits your use case on the Rate Limits configuration page. (supabase.com)
- Open Authentication > Rate Limits to view and configure the rate limits for your project. (supabase.com)
- Configure CAPTCHA protection for your project, which the docs describe as the most effective way to control bots. (supabase.com)
- To test email flows without hitting the sending limit, develop against local Supabase and read the emails in Mailpit. (supabase.com)
You can't see it yourself
You're signed in, your customers aren't. The email limit is counted across the whole project, not per person. Being signed in means you never go through the sign-up email step, while each new customer's sign-up or sign-in sends an email that counts against the same limit.
What to do next
App broke after you published it? Our AI agent fixes it in your code, then tests your live app again so you see the result yourself. The first check is free.
Fixed in your code, then tested live. Check my app free
Related: "email rate limit exceeded" in Supabase and Lovable: which limit you hit and how to fix it · Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44) · Supabase "Error sending confirmation email" (500): causes and how to fix it
Sources
VibeFix's check can show this on your live app: its AI agent signs up to your app like a new person, uses it on a phone and a computer, and shows what breaks.
Last checked: 30 October 2026, against the sources listed above.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.
Want it fixed?
Our AI agent fixes it in your code and tests your live app again. See pricing.
It starts with a free check that confirms the problem on your live app, no account needed.