A new person signs up, tries to sign in, and your app says "Email not confirmed". In code it comes back as an AuthApiError with the code email_not_confirmed ; public reports show the raw response as {"code":"email_not_confirmed","message":"Email not confirmed"} ( Supabase issue #29632 ). The account exists, but the person is locked out of it.

Supabase's error reference describes it as: "Signing in is not allowed for this user as the email address is not confirmed." The project is doing what it was told. With Confirm email on, users "will need to confirm their email address before signing in for the first time", and on hosted Supabase projects it is on by default. On self-hosted projects and in local development it is off by default, which is why an app can behave differently on a laptop than live.

So the real question is why this person is still unconfirmed. Supabase also advises identifying errors by error.code , not by matching the message text. Here are six reasons, in the order to check them.

1.…