Fix guides / Supabase: "AuthApiError: Email not confirmed"

How to fix Supabase "Email not confirmed" when users try to log in

Sign up works, the user tries to log in, and Supabase answers AuthApiError: Email not confirmed. Nothing is wrong with the password. Supabase projects require users to click a confirmation link before their first login, and in many AI-built apps that link either never arrives or lands on a broken page.

Why it happens

In Supabase, Authentication, Sign In / Providers, Email has Confirm email turned on by default. Until the user clicks the link in the confirmation email, signInWithPassword returns Email not confirmed. Three things usually break the chain:

• The built-in email service is rate limited to a handful of emails per hour and is meant for testing only, so emails silently stop arriving.
• The Site URL is still http://localhost:3000, so the link in the email goes nowhere.
• The app never tells the user to check their inbox, so they try to log in right away.

Fix 1: for testing, confirm the user by hand

In Authentication, Users, open the user and confirm them, or run this in the SQL editor:

update auth.users set email_confirmed_at = now()
where email = 'someone@example.com';

Fix 2: make confirmation emails actually arrive

1. Set up custom SMTP under Authentication, Emails, SMTP Settings (Resend, Postmark, SendGrid and similar all work). This removes the tight default limit.
2. Set Authentication, URL Configuration, Site URL to your live domain, and add your live and preview URLs to Redirect URLs.
3. Pass the redirect when signing up:

   await supabase.auth.signUp({
     email, password,
     options: { emailRedirectTo: `${window.location.origin}/welcome` },
   });

Fix 3: handle the error in your UI

const { error } = await supabase.auth.signInWithPassword({ email, password });
if (error?.message === 'Email not confirmed') {
  // show "Check your inbox" and offer a resend button
  await supabase.auth.resend({ type: 'signup', email });
}

Fix 4: turn confirmation off (only if you accept the trade-off)

Switching off Confirm email lets people log in immediately, but anyone can sign up with an address they do not own. It is fine for internal tools and early prototypes, not for apps that send email or take payments.

Check the fix

1. Sign up with a fresh address in a private window.
2. The email arrives within a minute and the link opens your live site, not localhost.
3. Login works after clicking it.

Last updated 2026-10-19.