Supabase confirmation or magic-link email not arriving (Lovable, Bolt)

Nothing on this page. CheckoutAlarm never sees your email.

It loads one page you pick and reads Stripe with a read-only key. It doesn't sign up, log in or read inboxes, so it never sees a missing sign-up email or a rate-limit error.

Free: 1 site, checked once a day. Pro: $19 a month, up to 3 sites checked hourly. You prove you own the site first. For Stripe we only take a restricted key with read access to Events, Webhook Endpoints and Charges. Full secret keys are refused. Compare plans

Until you set up your own SMTP server, Supabase Auth only sends to addresses on your Supabase organization's team. Everyone else fails with Email address not authorized. That's why it works for you and not for customers. Supabase: pre-authorized addresses

Supabase says the built-in server is limited to 2 messages per hour right now, that the limit can change without notice, and that there is no delivery guarantee. A few test sign-ups can use it up. Supabase: rate limits on the default server

Supabase works with any service that speaks SMTP. Its list includes Resend, AWS SES, Postmark, SendGrid, ZeptoMail and Brevo. With Resend you need an API key and a verified domain first. Resend: send with Supabase SMTP

In your Supabase project, open Authentication, then the email SMTP settings. Add a sender email and name. For Resend, the host is smtp.resend.com, the port is 465, the username is resend, and the password is your Resend API key. Keep that key out of your code and chat logs. Resend: SMTP credentials

After you switch, Supabase starts you at 30 messages per hour to protect your new sender. You can change it on the Rate Limits page. Supabase: custom SMTP rate limit

The error code over_email_send_rate_limit means too many emails were sent to this email address. Supabase says to ask the user to wait before trying again. Supabase answers with HTTP 429 when a rate limit is hit. Customers may see it as "email rate limit exceeded". Supabase: Auth error codes

The built-in server allows 2 emails an hour across the project. Sign-up, magic-link and password-reset requests also have a 60-second wait per user before another one can be sent. Supabase: Auth rate limits

You can only change the email limit after you set up custom SMTP (part 03) or a Send Email hook. Then open Authentication, then Rate Limits, in the dashboard. Supabase: Auth rate limits

That one counts requests from one IP address, not emails. Supabase notes a common cause in apps: a useEffect or similar code that calls sign-in again and again. Ask your AI builder to make sure the sign-in call only runs when the user clicks. Supabase: Auth error codes

The Site URL in URL Configuration is the default link target in confirmation and reset emails. If it still says http://localhost:3000, customers land on a page that doesn't exist. Set it to your live address. Supabase: redirect URLs

If your code passes redirectTo, that URL must match an entry in the Redirect URLs list. Wildcards help for preview URLs, but Supabase suggests an exact path for production. Supabase: wildcards in redirect URLs Full steps: magic link redirects to localhost.

When you use redirectTo, you may need to change {{ .SiteURL }} to {{ .RedirectTo }} in your email templates. Supabase: email templates with redirectTo

Your email service shows the DNS records for your sending domain. Supabase says these records make a big difference to delivery. Supabase: best practices

Supabase suggests short subjects, few links and images, no sales copy, and a separate sending domain for marketing email. Supabase: keep auth emails focused Full steps: emails sent with Resend going to spam.