FIX BY SYMPTOM
Signup or password reset emails not sending?
If Supabase confirmation or reset emails never arrive, you are probably still on the built-in email service: Supabase's docs say it only delivers to your project team's addresses and is limited to a few messages per hour, and it is not meant for production. Set up custom SMTP with a sending domain that has SPF and DKIM, then raise the rate limit. VibePitstop fixes broken signup and login email as part of an auth fix.
Why auth emails fail
- Built-in email service. Without custom SMTP, Supabase refuses addresses outside your team ("Email address not authorized") and rate-limits sending (2 per hour per its docs at the time of writing).
- Rate limits. Hitting the hourly cap returns over_email_send_rate_limit.
- No SPF, DKIM or DMARC. Mail from an unauthenticated domain lands in spam or is rejected.
- Links point to localhost or the preview. Templates use your Site URL; if it is wrong, users click a dead link.
- Confirmation required but never received. Users then hit email_not_confirmed.
Fix it
- Pick an SMTP provider (for example Resend, Postmark, AWS SES or SendGrid) and verify your sending domain there.
- Add the provider's SPF and DKIM DNS records, plus a DMARC record.
- In Supabase, Authentication settings: enable custom SMTP with host, port, user, password and a From address on your domain.
- Raise the email rate limit in Authentication, Rate Limits to fit your signups.
- Set the Site URL to your live domain and send yourself a test signup.
- Check Auth logs for hand-over errors if nothing arrives.
Sources: Supabase custom SMTP, Supabase Auth rate limits.
Want it fixed instead?
Auth & database security fix (Supabase, Firebase): from $400 (one issue); larger scope quoted up to $800 after diagnosis. The $149 diagnosis is credited toward any paid job.
Common worries, answered
- Will you mess up my repo? No. We work from read-only access, and every fix arrives as a pull request. Nothing merges until you merge it.
- Is this just more AI? AI coding agents help prepare fixes. A human reviews every fix before it ships.
- What if it still breaks? We keep working until the written scope is done, at no extra cost. Fixed, or we keep working free until it is (within the written scope).
- What about Stripe and my secret keys? Scoped access only. We never take full keys or owner logins; your secrets stay yours.
- How is this different from asking ChatGPT? We don't stop at advice. We fix and launch against a written scope.
Get a $149 diagnosis See pricing Fix my auth & database security
- Fixed, or we keep working free until it is (within the written scope).
- A human reviews every fix before it ships.
- read-only access; fixes arrive as pull requests you merge
- Your $149 diagnosis is credited in full toward any paid job.
FAQ
Why are Supabase confirmation emails not sending to my users?
Without custom SMTP, Supabase only sends to your project team's addresses and at a very low hourly limit. Configure custom SMTP.
Why do my auth emails go to spam?
The sending domain is missing SPF, DKIM or DMARC, or you are sending from a shared domain. Use your own verified domain.
Can you set this up for me?
Yes, as part of an auth & database security fix, from $400 (one issue); larger scope quoted up to $800 after diagnosis. You keep the SMTP account in your name.