Supabase error: Email address not authorized

What it means in plain English

The confirmation or reset email was refused before it was sent. With Supabase's built-in mailer, Auth only delivers to addresses that belong to your organization's team. Any other address fails with Email address not authorized. That mailer is for trying the product, not for real users.

Likely causes

• Custom SMTP is not turned on, so the built-in provider is still in charge.
• The address you are testing with is not a member of the Supabase organization. Team members are managed on the organization's Team tab.
• You expected the 2-emails-per-hour limit to be the only restriction. The team-address rule is separate.

How to fix it, step by step

1. If you are only testing, invite that inbox on the organization's Team tab, or test with an address that is already a member.
2. For a real app, set up custom SMTP. Supabase's guide says any SMTP provider works (Resend, Amazon SES, Postmark, SendGrid, and others). In the dashboard open the Authentication settings and enable custom SMTP with the host, port, user, password, and From address.
3. The production checklist puts those fields under Authentication → Emails → SMTP Settings.
4. After you save, Auth can send to any address. Supabase then starts you at 30 messages per hour. Raise that under Authentication → Rate Limits if you need more.
5. Turn off link tracking at the email provider so it does not rewrite Supabase's confirmation links.

How to check it worked

• Trigger a sign-up to an inbox that is not on your Supabase team. The message arrives, and Auth logs do not say the address is not authorized.
• The link in the email opens your live site, not localhost.

Sources

• https://supabase.com/docs/guides/auth/auth-smtp (opens in a new tab)
• https://supabase.com/docs/guides/deployment/going-into-prod (opens in a new tab)