Email not confirmed
The password was right, but the person hasn’t clicked the confirmation link Supabase emailed at sign-up, so sign-in is blocked.
Also appears as
- {"code":"email_not_confirmed","message":"Email not confirmed"}
Prompt to fix it
Users can’t sign in: Supabase returns "Email not confirmed". Check the sign-up flow: pass emailRedirectTo so the confirmation link returns to our app, tell me which Site URL and Redirect URLs to set in Supabase for local development and production, and make sure the page the link opens finishes the sign-in. On the login screen, handle the email_not_confirmed error with a clear message and a button that resends the confirmation email with supabase.auth.resend. Keep email confirmation on.
Paste into Layerwise or any AI coding tool.
What it means
Hosted Supabase projects turn on email confirmation by default. Sign-up creates the account and emails a link, and until the person clicks it, signing in with the correct password returns this error. Supabase checks the password first, so this message means the password was right.
The trap is where the link goes. Unless the sign-up call passes emailRedirectTo, the link sends people to the Site URL, which starts out as http://localhost:3000. After launch, users click the link, land on a page that doesn’t load, and never finish signing in.
For development, you can turn confirmation off so test accounts sign in right away. Turn it back on before launch, or anyone can sign up with an email address they don’t own.
Common causes
- The person hasn’t clicked the confirmation link yet, or the email went to spam.
- The link pointed at
http://localhost:3000, the default Site URL, so it never opened the live app. - The link expired or was already used, sometimes by an email security scanner that opens links before the person does.
- A test user was added in the dashboard without auto-confirm turned on.
How to fix it
- In Supabase, open Authentication, then URL Configuration. Set the Site URL to the live domain and add every app address to Redirect URLs.
- Pass
emailRedirectToinsignUpso the link returns to the right page. - Add a “Resend confirmation email” button that calls
supabase.auth.resend({ type: 'signup', email }). - Set up custom SMTP with an email provider so confirmation emails arrive reliably.
- For local testing only, turn off Confirm email in Supabase’s email provider settings, and turn it back on before launch.
Example fix
const { error } = await supabase.auth.resend({
type: 'signup',
email,
options: {
// Must be listed under Authentication > URL Configuration in Supabase.
emailRedirectTo: `${window.location.origin}/auth/callback`
}
});
if (error) setMessage(error.message);
else setMessage('We sent a new confirmation link. Check your inbox.');Related errors
All errorsInvalid login credentials
Supabase couldn’t match that email and password to an account that signs in with a password, and it deliberately doesn’t say which part was wrong.
Email rate limit exceeded
Supabase stopped sending sign-up, magic link, or reset emails because the project hit its hourly email limit, which is tiny with the built-in sender.
AuthSessionMissingError: Auth session missing
A Supabase auth call needed a signed-in user, but the client making it had no session, often because it runs on the server without cookies.
Error 400: redirect_uri_mismatch
Google stopped the sign-in because the return address your app sent isn’t on the OAuth client’s list of approved redirect URIs.
Build with an agent that checks its work
The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.