Email rate limit exceeded
Supabase stopped sending sign-up, magic link, or reset emails because the project hit its hourly email limit, which is tiny with the built-in sender.
Also appears as
- {"code":"over_email_send_rate_limit","message":"email rate limit exceeded"}
- AuthApiError: For security purposes, you can only request this after 42 seconds.
Prompt to fix it
Sign-up or magic link emails fail with "email rate limit exceeded". Tell me which Supabase email limits apply to this project, and walk me through setting up custom SMTP with a provider like Resend, including the DNS records for our domain and the Rate Limits setting to raise. In the code, stop duplicate sends: disable the button while the request runs, remove any retry loop, and show a friendly "try again in a minute" message for over_email_send_rate_limit. Don’t turn off email confirmation in production to avoid sending emails.
Paste into Layerwise or any AI coding tool.
What it means
Every Supabase Auth action that sends an email, including sign-up confirmations, magic links, password resets, and email changes, counts toward one hourly limit for the whole project. With Supabase’s built-in email sender, that limit is 2 emails per hour, so a few test sign-ups use it up.
The built-in sender is meant for trying things out. It also only delivers to the addresses of your Supabase organization’s team members; anyone else gets an error like Email address "jane@example.com" cannot be used as it is not authorized. Real users need your own email provider, connected as custom SMTP.
With custom SMTP, the limit starts at 30 emails per hour, and you can raise it under Authentication, then Rate Limits. A separate rule lets each address request a new link only once every 60 seconds by default. That’s the “For security purposes” message, and it applies with any email provider.
Common causes
- The project still uses Supabase’s built-in email sender, which allows 2 emails per hour.
- Repeated sign-up, magic link, or password reset tests during development used up the hour’s quota.
- The same request fires more than once, from a double click or a retry loop.
- Custom SMTP is set up, but the hourly limit is still the starting 30, which is too low for launch traffic.
How to fix it
- Pick an email provider such as Resend, Postmark, Amazon SES, or SendGrid, and verify your sending domain with it.
- In Supabase, open Authentication, then Emails, then SMTP Settings. Turn on custom SMTP and enter the provider’s host, port, username, and password.
- Raise the email limit under Authentication, then Rate Limits, to match the sign-ups you expect.
- During development, create test users from the dashboard with auto-confirm on so testing doesn’t send real emails.
- Disable the submit button while the request runs, and show “Try again in a minute” when the error code is
over_email_send_rate_limit.
Related errors
All errorsEmail not confirmed
The password was right, but the person hasn’t clicked the confirmation link Supabase emailed at sign-up, so sign-in is blocked.
429 Too Many Requests
The service is rate limiting you: too many requests arrived in a short time, so it refuses more until the limit resets.
Invalid login credentials
Supabase couldn’t match that email and password to an account that signs in with a password, and it deliberately doesn’t say which part was wrong.
Error 400: redirect_uri_mismatch
Google stopped the sign-in because the return address your app sent isn’t on the OAuth client’s list of approved redirect URIs.
Build with an agent that checks its work
The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.