Supabase Auth email rate limit or not sending — fix with Notify

Supabase’s built-in Auth mail is capped at 2 emails/hour and only delivers to team addresses — diagnose the error, then route Auth through a Send Email Hook + Notify.

Short answer: If Supabase Auth mail stops after one or two messages per hour, only reaches addresses on your org team, or shows Email address not authorized, you are still on Supabase’s default (built-in) email provider — 2 messages per hour, non-production only, and only to pre-authorized team addresses. For production, use Supabase’s Send Email Hook with an Edge Function that calls POST https://notify.cx/api/email/send (x-api-key, html body). Step-by-step: Recipe: Supabase Auth → Notify.

Why Auth mail stops or never arrives

Supabase documents two separate limits people confuse:

Supabase’s default SMTP is for exploring Auth and testing templates with your team, not production traffic. Notify does not expose SMTP, so you cannot point Supabase Custom SMTP at Notify — the supported path is the Send Email Hook → HTTPS send.

Context on hook vs SMTP: Supabase Auth emails without SMTP.

Quick diagnosis checklist

1. Authentication → Providers → Email — confirm sign-up / magic link / reset flows are enabled.
2. Still on default mail? In Auth SMTP settings, if Custom SMTP is off and no Send Email hook is configured, expect 2/hour and team-only recipients.
3. Test recipient — with the default provider, use an email that appears under the organization Team tab; any other address fails by design.
4. Authentication → Rate Limits — check rate_limit_email_sent after you move to Custom SMTP or a hook; built-in provider stays at 2 emails per hour until you change the mail path (rate limits table).
5. Authentication → Hooks → Send Email — if enabled, open Edge Function logs; hook failures block the Auth email step.
6. Notify side — production from must use a verified domain; new Notify accounts start sandbox_only until DNS verifies (sandbox vs production).

Fix: Send Email Hook → Notify

High level (full deploy + code in the recipe):

1. Notify: API key, verify sending domain.
2. Supabase secrets: NOTIFY_API_KEY, SEND_EMAIL_HOOK_SECRET (v1,whsec_... from the dashboard).
3. Edge Function: verify webhook with standardwebhooks, then fetch Notify:

const res = await fetch('https://notify.cx/api/email/send', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': Deno.env.get('NOTIFY_API_KEY')!
  },
  body: JSON.stringify({
    to: user.email,
    from: Deno.env.get('NOTIFY_FROM') ?? 'noreply@your-verified-domain.com',
    subject: 'Confirm your email',
    html: '<p><a href="...">Continue</a></p>'
  })
});

4. Dashboard: Authentication → Hooks → Send Email → HTTPS URL of the function (deploy with --no-verify-jwt per Supabase’s hook docs).
5. Smoke test: trigger signup or recovery; confirm in Notify logs.

Implementation source of truth: Recipe: Supabase Auth → Notify

When Custom SMTP instead of a hook?

Choose Custom SMTP if your provider gives you a real SMTP host (Resend, SES, Postmark, etc.). Choose the Send Email Hook when you want an HTTP API (Notify), custom HTML per action, or queuing — as Supabase describes in Auth SMTP under “Send Email Auth Hook”.

After Custom SMTP, Supabase notes a default 30 emails/hour cap until you raise it under Authentication → Rate Limits (Auth SMTP).

Notify limits (after you switch)

Notify bills on monthly plan quotas (Free 1,000/mo, Pro $10 / 10k, Scale $50 / 100k) — see pricing and usage limits. There is no separate “daily send cap” on the free plan; your app’s Supabase Auth endpoint limits still apply on Supabase’s side.

FAQ

What is Supabase’s built-in Auth email rate limit?

Supabase documents 2 messages per hour on the default (built-in) email provider, and states the cap can change without notice — auth-smtp. The rate limits page lists 2 emails per hour for “Emails sent by Supabase Auth” when using the built-in provider (rate limits).

Why does Supabase say “Email address not authorized”?

Without Custom SMTP, Auth only sends to pre-authorized addresses (org team members) — auth-smtp.

Can I use Notify with Supabase Custom SMTP?

No. Notify is HTTPS-only (POST /api/email/send). Use the Send Email Hook pattern — without SMTP.

Does the Send Email Hook replace built-in mail?

Yes — while the hook is enabled, it handles Auth email delivery for that project (send email hook).

I still get 429 from Auth endpoints — is that the email cap?

Not always. Sign-up, recover, and magic-link routes have separate IP and per-user limits (for example OTP resend windows) — rate limits.

Next step

1. Follow Recipe: Supabase Auth → Notify to deploy the hook.
2. If you are greenfield on Notify, get a key from Credentials or use agent bootstrap from an IDE.