email rate limit exceeded (Supabase Auth)

What it means in plain English

Supabase's built-in email sender is only for testing. It sends very few emails per hour across your whole project, so real users quickly hit the limit and get a 429 error.

Likely causes

• Using Supabase's default email provider in production (limit: 2 emails per hour per project).
• Lots of sign-ups/password resets during testing or launch.
• Per-user cooldown: by default a user must wait 60 seconds between OTP/magic link/reset requests.

How to fix it, step by step

1. Sign up with an email provider (e.g. Resend, Postmark, SendGrid, Amazon SES) and verify your sending domain.
2. Supabase → Authentication → Emails → SMTP Settings → enable custom SMTP and enter host, port, username, password and sender address.
3. Supabase then starts you at 30 emails/hour; raise it under Authentication → Rate Limits to suit.
4. During testing, avoid repeatedly signing up the same address.

How to check it worked

• Sign up with a fresh address; the email arrives within a minute.
• No 429 errors in the browser Network tab.

Sources

• https://supabase.com/docs/guides/auth/rate-limits (opens in a new tab)
• https://supabase.com/docs/guides/auth/auth-smtp (opens in a new tab)