Why is my Supabase confirmation email not sending (or "email rate limit exceeded")?

Supabase's docs list the built-in SMTP's restrictions:

• It only sends to team members. Unless you configure custom SMTP, Supabase Auth refuses to deliver to addresses that aren't in your organization's team. Real users never get the email.
• It has a tiny rate limit. The docs currently say 2 messages per hour, and that can change without notice. Once you hit it, you get email rate limit exceeded (HTTP 429).
• There's no delivery guarantee.

There's also a second limit that catches people out. After you switch to custom SMTP, Supabase starts you at 30 emails per hour until you raise it. And each user has to wait 60 seconds between signup confirmation, magic-link or reset requests.

1. Confirm it's a sending problem. Open Logs → Auth and look for Email address not authorized, 429 or rate limit around the failed signup.

2. Set up a sending domain with your email provider (for example Resend, Postmark, AWS SES or Brevo). Verify a domain you own, ideally a subdomain like auth.yourdomain.com, and add the SPF and DKIM DNS records the provider gives you.

3. Turn on custom SMTP in Supabase. Go to Authentication → Email (under Notifications) → SMTP Settings and fill in the details. The labels can shift a little between dashboard versions. For Resend, its docs give:

Host:      smtp.resend.com
Port:      465
Username:  resend
Password:  <your Resend API key>
Sender:    no-reply@auth.yourdomain.com
Name:      Your App

4. Raise the email rate limit in Authentication → Rate Limits ("Rate limit for sending emails") to something that fits your launch, such as 100 or more per hour. Leave the per-user 60-second window alone, since it protects your sending reputation.

5. Turn off link and open tracking at your email provider for auth emails. Supabase notes that tracking rewrites the links and breaks them.

6. Protect the form from bots. Public signup forms get abused once they can send real email. Supabase recommends CAPTCHA (hCaptcha or Cloudflare Turnstile). Turn it on under Bot and Abuse Protection → Enable CAPTCHA protection in your project's Auth settings, then pass the token to signUp:

await supabase.auth.signUp({ email, password, options: { captchaToken } });

7. Test with an address outside your team, on Gmail and on Outlook, and check the spam folder.

On Lovable Cloud these auth email settings live in the Cloud view's auth settings rather than a Supabase dashboard. Ask Lovable in chat to confirm where custom email sending is configured for your project.

Paste this into Lovable, Bolt, Cursor, Claude, ChatGPT, Replit, v0 or whichever tool you build with. Replace the bracketed parts first.

Our signup confirmation emails aren't arriving and the logs show "email rate limit exceeded" or "Email address not authorized". Please:
1. Check our signup and resend code. Show a clear message when Supabase returns a 429 ("Please wait a minute and try again") and add a "Resend email" button with a 60-second cooldown.
2. Add Cloudflare Turnstile to the signup form and pass captchaToken to supabase.auth.signUp.
3. Give me a step-by-step checklist for connecting custom SMTP (Resend) in Supabase and raising the email rate limit.
Don't disable email confirmation and don't change other pages.

Email delivery fails quietly. The signup form looks fine, users just never get the email. Watch your provider's dashboard for bounces, and check Logs → Auth after launches and traffic spikes.

Heedza checks that your live signup page loads and shows its form on a schedule, and it emails you a screenshot and a fix prompt when it doesn't. It doesn't send test emails through your provider, so keep an eye on your email dashboard as well. The free scan shows what Heedza checks on your live URL.