Guide
Supabase reset password email not sending: why a customer clicks "Forgot password" and gets nothing
When a Supabase password reset email never arrives and no error appears, the first thing to know is that this can be normal: Supabase does not reveal whether an account exists, so for an unknown address it sends nothing and still reports success. If the account does exist, the usual causes are the default email sender, a sending limit, or a reset link that leads nowhere.
Why it happens
resetPasswordForEmail asks Supabase to email a link that brings the person back to a change-password page in your app. Every part of that has to work for a customer: the account, the sender, the limits, the redirect and the page.
The causes, and how to fix each
1. There is no account under that address
Supabase says the reset call "doesn't reveal whether an account exists"; if no user matches, no email is sent and the call returns without an error. A customer who signed up with another address, or with Google, gets nothing.
How to fix it
- Ask the customer which address and which sign-in method they used.
- Look the address up under Authentication, Users in the Supabase dashboard.
- If they signed up with Google, they sign in with Google instead.
Source: Supabase: Password-based auth (reset flow, redirect URL, no account disclosure)
2. The default sender cannot reach the customer
Reset emails use the same sender as sign-up emails. Supabase's default service only delivers to the project's team, 2 messages an hour, and is not meant for production.
How to fix it
- Set up custom SMTP on the Authentication settings page (host, port, user, password and a From address on your domain).
- Check your Auth logs for a failed hand-over if emails still do not arrive.
Source: Supabase: Send emails with custom SMTP · Supabase troubleshooting: Not receiving Auth emails from the Supabase project
3. A sending limit was reached
With custom SMTP Supabase starts at 30 messages an hour. It also allows one reset request per user every 60 seconds by default, and limits requests per IP address. A customer pressing the button again and again, or many customers at once, hit these.
How to fix it
- Raise the email limit under Authentication, Rate Limits (after custom SMTP is set up).
- Tell customers to wait a minute before asking again.
Source: Supabase: Send emails with custom SMTP · Supabase: Rate limits
4. The reset link has nowhere to land
Supabase says redirectTo should point to a change-password page and that this URL must be on your redirect URLs. Without the page, or with an address not on the list, the email can arrive and still lead to the wrong place.
How to fix it
- Make sure the app calls resetPasswordForEmail with redirectTo set to its change-password page on your live address.
- Add that address under Authentication, URL Configuration, Redirect URLs.
- On the change-password page, take the new password and call updateUser with it.
- For server-side apps, Supabase's example reset template links to /auth/confirm with the token hash, type=recovery and next=/account/update-password.
Source: Supabase: Password-based auth (reset flow, redirect URL, no account disclosure) · Supabase: Redirect URLs
5. The link was used up before the customer clicked
Some email security tools open links in advance, which consumes a one-time link; the customer then sees "Token has expired or is invalid".
How to fix it
- Follow Supabase's email templates guidance for prefetching: send a one-time code instead of a link, or link to a page the customer has to click through before the token is used.
Source: Supabase: Email templates (link prefetching)
6. The email left Supabase and was blocked or filed as spam
Once handed to your provider, Supabase says it has no control over delivery. Providers keep suppression lists, and recipients' filters can quarantine the message.
How to fix it
- Check your email provider's logs for the address.
- Set up DKIM, DMARC and SPF with your provider, and send from your own domain.
Source: Supabase troubleshooting: Not receiving Auth emails from the Supabase project · Supabase: Send emails with custom SMTP
Why you can't see it yourself
You're signed in, your customers aren't. Your own address has an account and is on the team, so your reset email goes out. You ask once, so you never hit a limit, and you open the link right away.
Frequently asked questions
Why does Supabase say the reset email was sent when nothing arrives?
Supabase does not reveal whether an account exists. If the address has no account, no email is sent and the call still returns without an error.
Where should the Supabase reset link take the user?
To a change-password page in your app, given as redirectTo and listed under Redirect URLs. That page calls updateUser with the new password.
Why does the reset link say "Token has expired or is invalid"?
The one-time link may have been opened already, for example by an email security tool that prefetches links. Supabase suggests a one-time code or a click-through page.
Do reset emails share limits with sign-up emails?
Yes. They go through the same sender, so the default service's team-only rule and the hourly email limit apply to both.
Sources (official documentation)
- Supabase: Password-based auth (reset flow, redirect URL, no account disclosure)
- Supabase: Send emails with custom SMTP
- Supabase troubleshooting: Not receiving Auth emails from the Supabase project
- Supabase: Rate limits
- Supabase: Redirect URLs
- Supabase: Email templates (link prefetching)
Related guides
- Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44)
- Lovable email rate limit exceeded (and the Supabase "email rate limit exceeded" error): what is being limited
- Supabase error sending confirmation email (500): what it means and why it happens
- Base44 reset password link invalid or expired
- The confirmation link in my sign-up email opens localhost
- Supabase login not working on my published Lovable app (works in preview)
- Supabase redirect URL localhost: keep it for testing, send real users to your live app
VibeFix is independent. Supabase, Lovable and Base44 are trademarks of their owners.
Fixed it? Prove a real stranger gets in
A fix that works from your own account proves nothing about a new customer. Your AI reads your code. VibeFix signs up like a stranger.
Free check. Paste your live app's link: an AI agent signs up to your live app once as a brand-new person ("VibeFix Test") with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user still hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.
$9 for one app. If something is still broken, $9 tells you which of these causes is breaking your app and where, gives you a fix prompt written for your app, and includes 3 re-checks so you can see the result from the outside. It does not promise a fix; it shows what the agent saw.