SupabaseAuth

Supabase: Email not confirmed

AuthApiError: Email not confirmed

In short: The user exists, but Supabase will not issue a session until the confirm-email link has been used, or the confirm email never arrived.

Why it happens

When 'Confirm email' is enabled (the default on many projects), signUp creates the user in auth.users and returns no session until they click the link in the confirmation email. signInWithPassword then throws Email not confirmed. AI-built apps often send the user to a logged-in screen immediately after signup, so this looks like a broken login. The other half of the problem is delivery: Supabase's built-in mailer is for testing, is rate limited (email rate limit exceeded), and often lands in spam. If Site URL or the redirect URL is still http://localhost:3000, the link in the email also goes to the wrong host.

How to fix it

1. In Supabase, open Authentication → Users and find the person. If they exist and email_confirmed_at is empty, the account was created and they have not confirmed yet. That is this error, not a wrong password.
2. Check Authentication → Providers → Email: 'Confirm email' is the setting that requires the link. For a production app, leave it on and fix delivery. Only turn it off on a throwaway project where you accept that anyone can sign in with an unverified address.
3. Open Authentication → URL Configuration. Set Site URL to your live origin (https://yourdomain.com or the Lovable URL) and add that origin to Redirect URLs so the confirm link returns to the app, not to localhost.
4. For real users, add a custom SMTP sender (Authentication → Emails, or Project Settings → Authentication) on a domain you have verified with SPF and DKIM. Ask the user to check spam. If you hit email rate limit exceeded, wait or switch to custom SMTP; don't have the AI retry signup in a loop.
5. In the app, after signUp, show 'Check your email to confirm your account' instead of treating the response as a logged-in session. Add a 'Resend confirmation email' button that calls supabase.auth.resend({ type: 'signup', email }). Once they confirm, signInWithPassword will work.

Example

const { data, error } = await supabase.auth.signUp({ email, password });
if (error) throw error;
if (!data.session) {
  // Confirm email is on: no session until they click the link.
  setMessage("Check your email to confirm your account.");
}

Copy-paste fix prompt

I'm getting this error in my app:

AuthApiError: Email not confirmed

[Paste the full error, stack trace, and the file it points to here]

Likely cause: The user exists, but Supabase will not issue a session until the confirm-email link has been used, or the confirm email never arrived.

Task: signInWithPassword returns Email not confirmed. Check whether the user exists and is unconfirmed, fix Site URL and redirect URLs so the confirm link hits the live app, improve email delivery (custom SMTP, not the test mailer), and change the signup UI to wait for confirmation and offer a resend. Don't disable confirm-email in production.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Lovable, Bolt, Cursor, v0. Last reviewed 2026-11-15.