How to fix email_address_invalid: Email address validation failed in Supabase

SupabaseBEGINNERMEDIUMUpdated Dec 18, 2025· 312 views

Supabase Auth rejects an email address during signup or authentication due to format validation rules. This typically occurs when the email format violates Supabase's validation requirements, which may be stricter than standard RFC 5322 specifications.

Quick fix

Fixes email_address_invalid

// Test with a standard email format first
const standardEmail = 'user@example.com';

const { data, error } = await supabase.auth.signUp({
  email: standardEmail,
  password: 'secure-password-123',
});

if (error) {
  console.error('Validation error:', error.message);
} else {
  console.log('Success with standard format');
}
  1. Verify the email format matches common patterns
  2. Remove special characters from email addresses
  3. Check domain name length requirements
  4. Implement client-side validation matching Supabase rules
supabase — error
// Test with a standard email format first
const standardEmail = 'user@example.com';
const { data, error } = await supabase.auth.signUp({
  email: standardEmail,
  password: 'secure-password-123',
});
if (error) {
  console.error('Validation error:', error.message);
} else {
  console.log('Success with standard format');
}
email_address_invalid: Email address validation failed

What this error means

This error occurs when Supabase Auth's email validation logic determines that the provided email address doesn't meet its format requirements. While the email might appear valid to you, Supabase enforces specific validation rules that can reject certain technically valid email formats. Common issues include email addresses with unusual but RFC-compliant characters (like "+" symbols), very short domain names (like "a@a.com"), or formats that Supabase's validator doesn't recognize as legitimate. The validation happens server-side during authentication operations like signup, sign-in, or password reset requests. Supabase returns a 400 Bad Request status with the error code "email_address_invalid" when this validation fails, preventing the authentication operation from proceeding.

Typical symptoms

  • User signup fails immediately after submitting email address
  • API returns 400 status code with "email_address_invalid" error
  • Error message states "Email address validation failed"
  • Technically valid email addresses (with + symbols) are rejected
  • Very short domain names (single character) trigger validation errors
  • Authentication operations (password reset, magic links) fail for certain email formats

Common causes

  1. Email address contains special characters like "+" that Supabase validation rejects (despite being RFC 5322 compliant)
  2. Domain name is too short (less than 3 characters) per Supabase's validation rules
  3. Email format is unusual but technically valid according to RFC 5322 standards
  4. Supabase's email validator is stricter than standard email validation libraries
  5. Email address contains Unicode characters or internationalized domain names that aren't supported
  6. Client-side validation passed but server-side Supabase validation uses different rules

How to fix "email_address_invalid: Email address validation failed"

1Verify the email format matches common patterns

First, check that the email address follows a standard format that Supabase expects:

javascript
// Test with a standard email format first
const standardEmail = 'user@example.com';

const { data, error } = await supabase.auth.signUp({
  email: standardEmail,
  password: 'secure-password-123',
});

if (error) {
  console.error('Validation error:', error.message);
} else {
  console.log('Success with standard format');
}

If this works, your original email likely contains characters or patterns that Supabase doesn't accept.

2Remove special characters from email addresses

If you're using the "+" symbol for email aliasing (like user+test@example.com), try the base email instead:

javascript
// Instead of: user+test@example.com
// Use: user@example.com

// If you need to track different signups, use metadata instead
const { data, error } = await supabase.auth.signUp({
  email: 'user@example.com',
  password: 'secure-password-123',
  options: {
    data: {
      signup_source: 'test_campaign',
    },
  },
});

Store tracking information in user metadata rather than email aliases.

3Check domain name length requirements

Supabase requires domain names with at least 3 characters. Avoid very short domains:

javascript
// ❌ Will fail: domain too short
const invalidEmail = 'user@a.co';

// ✅ Should work: standard domain length
const validEmail = 'user@example.com';

// Validate domain length before submission
function isValidSupabaseDomain(email) {
  const domain = email.split('@')[1];
  if (!domain) return false;

  const parts = domain.split('.');
  return parts.every(part => part.length >= 2); // At least 2 chars per segment
}

if (isValidSupabaseDomain(email)) {
  await supabase.auth.signUp({ email, password });
} else {
  alert('Please use an email with a standard domain format');
}
4Implement client-side validation matching Supabase rules

Add validation on your frontend to catch issues before submission:

javascript
function validateSupabaseEmail(email) {
  // Basic format check
  const emailRegex = /^[a-zA-Z0-9._-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;

  if (!emailRegex.test(email)) {
    return { valid: false, error: 'Invalid email format' };
  }

  // Check for special characters that might cause issues
  if (email.includes('+')) {
    return {
      valid: false,
      error: 'Email addresses with + are not supported'
    };
  }

  // Verify domain length
  const domain = email.split('@')[1];
  const domainParts = domain.split('.');

  for (const part of domainParts) {
    if (part.length < 2) {
      return {
        valid: false,
        error: 'Domain segments must be at least 2 characters'
      };
    }
  }

  return { valid: true };
}

// Usage in form
async function handleSignup(email, password) {
  const validation = validateSupabaseEmail(email);

  if (!validation.valid) {
    setError(validation.error);
    return;
  }

  const { error } = await supabase.auth.signUp({ email, password });
  if (error) {
    setError(error.message);
  }
}
5Handle validation errors gracefully in your UI

Provide clear feedback when email validation fails:

javascript
async function signupWithErrorHandling(email, password) {
  try {
    const { data, error } = await supabase.auth.signUp({
      email,
      password,
    });

    if (error) {
      if (error.message.includes('email_address_invalid')) {
        return {
          success: false,
          message: 'Please use a standard email format (e.g., name@example.com)',
          suggestion: 'Avoid special characters and very short domain names',
        };
      }
      return { success: false, message: error.message };
    }

    return { success: true, data };
  } catch (err) {
    return {
      success: false,
      message: 'An unexpected error occurred during signup'
    };
  }
}

// In your component
const result = await signupWithErrorHandling(email, password);
if (!result.success) {
  setErrorMessage(result.message);
  if (result.suggestion) {
    setHelpText(result.suggestion);
  }
}

Advanced notes

Supabase Validation vs RFC 5322

Supabase's email validation is intentionally stricter than RFC 5322 (the official email standard) to reduce spam and abuse. While addresses like "user+tag@example.com" or "user@a.com" are technically valid per RFC 5322, Supabase may reject them to enforce security and deliverability best practices.

Known Validation Quirks

According to GitHub issues in the Supabase Auth repository, specific patterns known to cause validation failures include:
- Plus (+) symbols in the local part (before @)
- Domain names with segments shorter than 2-3 characters
- Certain Unicode or internationalized domain names

These restrictions are documented in various GitHub issues (#2252, #35082) but aren't explicitly detailed in official documentation.

Custom SMTP and Team Restrictions

Even if your email passes format validation, Supabase Auth has additional restrictions in development. Without a custom SMTP configuration, Auth will only send emails to team members of your project. This is a separate concern from format validation but can appear similar to end users.

Workarounds for Edge Cases

If you have users with legitimately unusual email addresses that Supabase rejects:
1. Consider implementing phone-based authentication as an alternative
2. Use OAuth providers (Google, GitHub) which handle their own email validation
3. For enterprise customers, configure a custom SMTP server which may offer more flexible validation

Monitoring and Debugging

Check your Supabase Auth logs in the dashboard under Authentication > Logs. Failed validation attempts appear with error code "email_address_invalid" and include the rejected email format (with sensitive parts redacted). This helps identify patterns in validation failures.

Frequently asked questions

What does "email_address_invalid" mean?
This error occurs when Supabase Auth's email validation logic determines that the provided email address doesn't meet its format requirements. While the email might appear valid to you, Supabase enforces specific validation rules that can reject certain technically valid email formats. com"), or formats that Supabase's validator doesn't recognize as legitimate.
How do I fix "email_address_invalid"?
Supabase Auth rejects an email address during signup or authentication due to format validation rules. This typically occurs when the email format violates Supabase's validation requirements, which may be stricter than standard RFC 5322 specifications.
What causes "email_address_invalid"?
Email address contains special characters like "+" that Supabase validation rejects (despite being RFC 5322 compliant) Domain name is too short (less than 3 characters) per Supabase's validation rules Email format is unusual but technically valid according to RFC 5322 standards
Is the "email_address_invalid" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading