VVibeFix

Guide

Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44)

Updated

If new users never get the Supabase confirmation email, the usual reason is the default sender: Supabase says it only reaches your project's team, sends 2 an hour and is not for production. The fix is your own sender (custom SMTP).

In our checks of 44 live AI-built apps, almost 1 in 4 (10 of 44) had a sign-up, login or verification-email problem that stopped a new person getting in.

Can a stranger actually sign up and get your email? Get it fixed: a free check first confirms the problem on your live app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Want it fixed? Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front.

What we add from real checks: the addresses the owner tries are on the project's team, so the email arrives for them. The first new customer, signing up on the live address, is the first one who gets nothing.

Lovable and Base44 apps send through their own services, with their own limits, covered below.

Why it happens

Sign-up only finishes when the person clicks the link or enters the code in that email. Whatever sends your app's emails decides who gets them, how many go out per hour and whether they land in the inbox. The default senders are made for trying things out, not for strangers arriving from an ad or a post.

The causes, and how to fix each

1. Supabase's default sender only delivers to your team

Unless you set up your own SMTP server, Supabase only sends to addresses that are part of the project's team. Everyone else's message fails (the error code is email_address_not_authorized). Every address you test with is on the team; a new customer's is not.

How to fix it

  1. From your email provider, get the SMTP server host, port, user and password, and choose a From address on your own domain (for example no-reply@yourdomain.com).
  2. In the Supabase dashboard, open the Authentication settings page and enable custom SMTP.
  3. Enter the host, port, user, password and From address, and save.
  4. Sign up with an address that is not on your team and confirm the email arrives.

Source: Supabase: Send emails with custom SMTP

2. The hourly email limit was reached

The default service sends 2 messages per hour for the whole project. Once custom SMTP is saved, Supabase starts you at 30 messages per hour. A few sign-ups close together, or a launch day, use that up and later people get nothing.

How to fix it

  1. Set up custom SMTP first (cause 1). Supabase says the email limit can be configured once you use custom SMTP or a Send Email hook.
  2. Open Authentication, Rate Limits in the dashboard.
  3. Raise the email limit to fit the sign-ups you expect, within what your email provider allows.

Source: Supabase: Send emails with custom SMTP · Supabase: Rate limits

3. Your own sender is connected, but the hand-over fails or mail lands in spam

Supabase hands the message to your provider. A wrong setting stops that hand-over; after it, Supabase says it "has no control over email delivery". Providers keep suppression lists of addresses that bounced before, and recipients' mail filters can quarantine or spam the message.

How to fix it

  1. Check your project's Auth logs first; a failed hand-over shows there.
  2. Then check your email provider's own logs for blocked or suppressed addresses.
  3. With your provider, set up DKIM, DMARC and SPF for the sending domain.
  4. Send from your own domain, and keep sign-in emails separate from marketing emails (a separate sending domain or From address).

Source: Supabase troubleshooting: Not receiving Auth emails from the Supabase project · Supabase: Send emails with custom SMTP

4. Lovable: the project's hourly email cap

Lovable apps on Lovable's built-in backend have a per-project "Rate limit for sending emails" that caps sign-in emails per hour; Lovable says it is the first thing to check when confirmations stop arriving after many sign-ups. Lovable's Emails feature also limits how many authentication emails a workspace sends per hour (Pro 500, Business 3,000, Enterprise 10,000), and at a workspace limit Lovable rejects new emails until the hour resets.

How to fix it

  1. Open More, Users, Settings, Email, and look under Advanced for "Rate limit for sending emails".
  2. Raise it to match your expected sign-ups. Lovable notes that raising the sending limit needs managed email or a verified custom domain first.
  3. Open More, Emails to see the workspace usage; Lovable shows a warning at 80% of a limit. For a higher workspace limit, contact Lovable Support.

Source: Lovable: Email authentication for your app · Lovable: Send branded emails from your own domain

Your AI reads your code. VibeFix signs up like a stranger. Get it fixed: a free check first confirms the problem on your live app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Want it fixed? Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front.

5. Lovable: emails from a new domain land in spam

Lovable says emails from new domains often land in spam. On a paid workspace you can send sign-in emails from your own domain, with Lovable handling the DNS, SPF, DKIM and DMARC.

How to fix it

  1. Ask people who are waiting to check their spam folder first.
  2. Open More, Emails and click Get started (a paid workspace, a domain you own and access to its DNS are required).
  3. Enter your domain and keep or change the sender subdomain (Lovable creates notify by default), then click Set up domain.
  4. Add the records Lovable shows. Add the NS records inside your DNS zone for the subdomain host shown; do not replace your domain's nameservers at your registrar.
  5. Wait for the status to show Verified (usually a few hours, up to 72), then send a test sign-up.

Source: Lovable: Email authentication for your app · Lovable: Send branded emails from your own domain

6. Base44: the 6-digit code never arrives

Base44 sends a 6-digit code that works for 10 minutes, from no-reply@base44-apps.com unless you set up your own email domain. Email verification cannot be turned off, so a person without the code cannot log in with their password.

How to fix it

  1. Ask the person to check spam or junk, wait a few minutes, add no-reply@base44-apps.com to their safe senders and check the address for typos.
  2. They can ask for a new code from the verification screen, or sign up again with the same address.
  3. If it still fails, remove their record from the Users list in your dashboard and ask them to sign up again. If several people report it at once, contact Base44 Customer Care with your app URL and the affected addresses.
  4. To send from your own domain (Starter plan or above, with a domain connected): Dashboard, Domains, Email domain, Use Your Custom Domain. Add the 3 CNAME records Base44 shows and wait for the status to be Active (up to 48 hours).

Source: Base44: Managing login and registration · Base44: Sending emails from a custom domain

7. The person missed the first email and cannot get another

A person who deleted the email or typed a wrong address is left with an unconfirmed account. In Lovable, signing in again does not resend the email.

How to fix it

  1. Supabase: give the app a "resend email" button that calls supabase.auth.resend with type signup and the person's address.
  2. Lovable: the person signs up again with the same address. You can also add them yourself under More, Users, Add user, Create new user; users added this way are confirmed automatically.

Source: Supabase JavaScript reference: resend() · Lovable: Email authentication for your app

How to tell it's fixed

  1. On the live address, sign up with a fresh address that is not on your project's team (a new free mailbox works).
  2. The email arrives in the inbox, not spam, within a few minutes.
  3. Its link opens your live address, not localhost or the preview, and the account is confirmed.
  4. The project's Auth logs show the email sent with no error.

The main catch

Your own sign-ups prove nothing: your address is on the team, you never reach the hourly limit, and your mail provider knows you. Test with a new address. If the email arrives but its link opens localhost, that is a different setting: see the confirmation link opens localhost.

Why you can't see it yourself

You're signed in, your customers aren't. Your own address is on the team, so Supabase's default sender accepts it. You sign up once, so you never reach an hourly limit. Your mail provider knows you. A new customer is outside every one of those.

Frequently asked questions

Why is Supabase not sending confirmation emails?

Most often because the project still uses the default email service, which only delivers to addresses on the project's team and sends 2 messages an hour. Set up custom SMTP under Authentication settings, then check the Auth logs if emails still do not arrive.

How many emails can Supabase send per hour?

The default service sends 2 per hour. After you set up custom SMTP, Supabase starts at 30 per hour, which you can change on the Rate Limits page. Your email provider may have its own limits.

How do I resend the Supabase confirmation email?

Call supabase.auth.resend with type signup and the person's email address, for example from a "resend email" button on your sign-in page.

Why do my Lovable confirmation emails go to spam?

Lovable says emails from new domains often land in spam. You can send from your own domain under More, Emails, and Lovable's deliverability advice is to let volume grow gradually and send only emails triggered by something the person did.

Can I turn off email confirmation?

In Supabase, Confirm email is a setting, and Supabase says it is on by default for hosted projects. Lovable has an Auto-confirm email switch. Base44 does not let you turn verification off. Without confirmation, people get in without proving the address is theirs.

Can VibeFix fix it for me?

Yes, if you ask. The free check confirms the problem first. Our AI agent can find the cause, fix it in your code and re-check your live app: $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.

Sources (official documentation)

Related guides

VibeFix is independent. Supabase, Lovable, Bolt and Base44 are trademarks of their owners.

Fixed it? Prove a real stranger gets in

A fix that works from your own account proves nothing about a new customer. Your AI reads your code. VibeFix signs up like a stranger.

Free check. Paste your live app's link: an AI agent signs up to your live app once as a brand-new person ("VibeFix Test") with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user still hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.

Check my live app, free

Want it fixed?

Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.

It starts with a free check that confirms the problem on your live app, no account needed.

Get it fixed — free check first

More guides