Guide
Supabase magic-link emails not delivered to your users
A customer asks for a magic link and nothing arrives in their inbox. This guide applies to apps built with AI app builders that use Supabase Auth as their backend.
Why it happens
Supabase Auth sends email through a built-in SMTP server unless you configure your own. That built-in server is meant for exploring and testing, not for production, and it only sends to addresses on the project's team.
Possible causes
- No custom SMTP server is configured, so Supabase Auth refuses to deliver messages to addresses that are not part of the project's team.
- The recipient is not a member of the project's team, and the built-in server sends only to pre-authorized addresses.
- The built-in email provider is capped at 2 messages per hour, and that value can change without notice.
- The email provider blocks delivery, for example because of past bounced-back emails or a suppression list.
- The recipient's email firewall or spam filter blocks or quarantines the message, which can happen with the default provider.
- The message went to spam.
Official fix steps
- Check your project's Auth logs for errors that can occur when handing over to the email providers. (supabase.com)
- If you use a custom SMTP provider, look at its logs next, since handover issues can come from misconfiguration. (supabase.com)
- Choose an email sending service, create an account and get its SMTP server host, port, user and password. (supabase.com)
- Choose a default From address, usually something like no-reply@example.com. (supabase.com)
- Go to the Authentication settings page to enable and configure custom SMTP, then save the settings. After that, your project's Auth server sends messages to all addresses. (supabase.com)
- Adjust the low rate limit of 30 messages per hour on the Rate Limits configuration page to suit your use case. (supabase.com)
- Ask the user to check with their email server admin whether your email domain is blocked or the mail is quarantined. (supabase.com)
You can't see it yourself
You're signed in, your customers aren't. The built-in server only sends to addresses on the project's team, so an address that belongs to the team can receive messages while a new customer's address fails with the error "Email address not authorized". Testing with your own address can therefore look fine even when customers get nothing.
What to do next
Want it fixed? Our AI agent finds which cause is breaking your app, fixes it in your code and re-checks your live app.
Related: Supabase reset password email not sending: why a customer clicks "Forgot password" and gets nothing · Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44) · "email rate limit exceeded" in Supabase and Lovable: which limit you hit and how to fix it
Sources
VibeFix's check can show this on your live app: its AI agent signs up to your app like a new person, uses it on a phone and a computer, and shows what breaks.
Last checked: 29 October 2026, against the sources listed above.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.
Want it fixed?
Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.
It starts with a free check that confirms the problem on your live app, no account needed.