Email not confirmed (Supabase Auth)
Filed under Supabase & databases
The account was created but the confirmation link in the signup email was never clicked — or it points at the wrong address, so clicking it never completes.
Fastest route
Give your AI this prompt
Copy it, replace the bracketed part with your error, and send it.
Preview the prompt
I am using Supabase Auth and login fails with "Email not confirmed" (email_not_confirmed), even with the correct password. Context: [this is my own test account / this is happening to real users]. The app is deployed at: [your real domain]. My signup code is: [paste the signup and login code]. Please: 1) explain what state this account is in and what completes it, 2) add a "resend confirmation email" action to my login page using the auth resend call with type "signup", and show the user a clear message when login fails for this reason, 3) list the exact Supabase dashboard settings I should check (Site URL and redirect URLs under Authentication) so confirmation links land on my real domain. Constraints: do not suggest turning off email confirmation as the fix, do not auto-confirm users in code, and keep the signup flow itself unchanged.
Fix it yourself
Follow the repair
- Understand what the error is protecting. This message is not saying the password is wrong — it is saying the account has not finished being created. As long as the email stays unconfirmed, even a perfect password gets this exact refusal. That is why resetting the password changes nothing; the missing step is the click, not the credentials.
- Find the confirmation email and click the link. Search the inbox of the address you signed up with for a message from your Supabase project — subjects are usually along the lines of "Confirm your signup". Check spam and promotions folders carefully; first emails from a new sender are prime spam-filter targets. On a phone, also check the "all mail" view if your app sorts aggressively.
- Resend a fresh confirmation if the link has aged out. Confirmation links expire, and clicking an expired one can look like nothing happened. Trigger a new email — your app may already have a resend option — or call the auth resend method from a test page or your builder:
Then click the link in the newest email only. Older links in the same inbox are dead and will just confuse the test.await supabase.auth.resend({ type: "signup", email: "[email protected]", }); - Check the Site URL and redirect addresses point at your real app. In the Supabase dashboard, open Authentication, then URL Configuration. The Site URL should be your real, deployed address, and the redirect URL list should include the pages confirmation lands on. If these still say
http://localhost:3000— the default from development — every confirmation email sends users to an address on your computer, which does nothing on theirs. This is the single most common reason "email confirmation broke when we launched." - Confirm your own test users by hand in the dashboard. While building, you will create throwaway accounts constantly, and clicking email links for each one is a slog. Open Authentication, then Users, find the account, and use its menu to confirm the email manually. Reserve this for accounts you control; real users should always complete the real flow, which is also how you find out the flow is broken.
- Only for early development: turn confirmation off, deliberately. In Authentication, under Providers, Email, you will find the Confirm email toggle. Switching it off makes test signups work instantly. It also removes the proof that an address belongs to the person signing up, so anyone can register with anyone's email. Use it while you build if it helps — and put "turn email confirmation back on" on your launch checklist, in writing, today.
Why this happensOptional explanation
Email confirmation exists to prove that the person who created an account actually controls the email address on it. Without that check, anyone could register an account using your address. So when Confirm email is switched on in Supabase — and it is on by default for the email provider — a new account waits in a half-created state: the password is set, the user row exists, but every login attempt is refused with this error until the link in the confirmation email gets clicked.
The frustrating part is how many ways that click can fail to register. The email lands in spam and is never seen. It is seen a day later, after the link has expired. Or — the one that bites vibe coders hardest — the link works exactly as configured, but the configuration still points at localhost from development days, so the confirmation lands on an address that only exists on your own machine, or on an old deployment domain. From the user's chair it looks like they clicked and nothing happened; from Supabase's chair, the confirmation simply never arrived.
- Never clicked: the confirmation email is in spam, promotions, or the wrong inbox entirely.
- Clicked too late: links expire; an old email's link is dead even though it looks identical to a fresh one.
- Clicked into the void: the Site URL still points at localhost or an old domain, so the landing page that completes confirmation never loads.
- Created unconfirmed: test users made through the dashboard or imports may start unconfirmed and need a manual nudge.
Quick answers
I created the user in the dashboard. Why is it still unconfirmed?
It depends how they were made. Users imported or created through some admin paths start unconfirmed unless the creation explicitly marks the email as confirmed. Open the user in the dashboard's Users list to check their status, and confirm them there if they are your own test accounts.
The confirmation link says it is expired or invalid. What now?
Confirmation links expire, and only the newest one works — resend a fresh email and click that one, ignoring the older messages. If even a fresh link fails instantly, check the Site URL and redirect settings: the link may be landing on the wrong domain and dying there.
Can I just turn off email confirmation?
You can, in the Email provider settings, and during early development many people do so they can test freely. Turn it back on before real users arrive: without it, anyone can register accounts with email addresses they do not own, including someone else's.