Your app is ready. The sign-in email is not arriving.

Why the sign-in email does not arrive

• 2 emails per hour

  The email built into Supabase Auth sends 2 per hour for the whole project. Your first two sign-ups use it up.

• Only your team receives

  Without custom SMTP, only members of your Supabase organization get the email. Your users get email_address_not_authorized.

• The chat does not change it

  With your own Supabase project, Auth settings live in the Supabase dashboard, not in Lovable. The SMTP goes there; the prompt below fixes the app side.

• Links to localhost

  A confirmation link pointing to localhost or to the preview URL looks like an email that does not work. The prompt asks for the production URL.

Supabase numbers from its Auth documentation, checked on October 20, 2026. Lovable behavior from its Connect to Supabase page, checked on October 24, 2026. If your project uses Lovable's built-in backend instead of your own Supabase project, Lovable sends the sign-in emails itself and this path does not apply.

The fields to paste

In the Supabase dashboard: Authentication > Emails > SMTP Settings, turn on Enable Custom SMTP and fill in:

Save, then open Authentication > Rate Limits and raise the emails per hour. When custom SMTP is saved, Supabase starts it at 30 per hour; this is the step most people forget.

The prompt to paste in Lovable

Swap the sample sender for yours and paste it in the Lovable chat (it works in Bolt too). It fixes the redirect links, the reset page and the 429 message, and gives you the Supabase checklist. The key never goes into the code.

My app signs people in with my own Supabase project. Its Auth emails (sign-up confirmation, magic link and password reset) will now go out through Couryo's SMTP, from the sender no-reply@auth.yourapp.com. I will fill in the SMTP settings myself in the Supabase dashboard: never ask for the SMTP password and never write it to any file of the project.

Please change the code:
1. In signUp, signInWithOtp and resetPasswordForEmail, pass emailRedirectTo (or redirectTo) with the production URL of the app, never localhost.
2. Create a /reset-password page that reads the session from the link and calls supabase.auth.updateUser({ password }).
3. When Supabase answers 429 or over_email_send_rate_limit, show "We just sent you an email. Check your inbox and spam folder; you can ask again in 1 minute." and disable the resend button for 60 seconds, with a countdown.
4. Then give me this checklist for the Supabase dashboard:
   - Authentication > Emails > SMTP Settings: turn on Enable Custom SMTP. Host smtp.couryo.com, Port number 587, Username couryo, Password = my Couryo API key with the send scope, Sender email no-reply@auth.yourapp.com, Sender name = the name of my app.
   - Authentication > Rate Limits: emails per hour for my sign-up peak.
   - Authentication > URL Configuration: Site URL and Redirect URLs on the production domain.

Three steps, no code change

1. 1

   Verify the sending domain

   In Couryo, under Domains, add the domain (an auth subdomain such as auth.yourapp.com keeps sign-in apart from marketing). Each DNS record shows its status live, with Cloudflare in one click.

2. 2

   Create the SMTP key

   In the panel, Keys > Connect to Supabase creates a key with the send scope only and shows every field with a copy button. The full key is shown once.

3. 3

   Paste, save and test

   Paste the fields in Supabase, raise the rate limit and sign up a test user. The email shows up in Couryo's timeline: accepted, sent, delivered, with the receiving server's answer in plain words.

Full guide: Supabase Auth with custom SMTP

What it costs

Auth emails are transactional: they go out on any plan, including Free.

• Free

  $0 forever

  • 3,000 emails a month
  • Up to 100 a day
  • 1 verified domain
  • Timeline of every email

• Pro

  $19 a month

  • 50,000 emails a month
  • 10 domains
  • 30-day logs
  • Cancel in one click

Every plan and the calculator