How to fix email_address_not_authorized: Email sending to this address is not authorized in Supabase
Supabase Auth restricts email sending to pre-authorized addresses when using the default email provider. This error occurs when trying to send authentication emails to addresses not in your project's authorized list.
Quick fix
Fixes email_address_not_authorized: Email sending to this address is not authorized
const { error } = await supabase.auth.signUp({
email: 'test@example.com',
password: 'TestPassword123!',
});
if (error) {
console.error('Sign up error:', error.message);
} else {
console.log('Sign up successful - check email for confirmation');
}- Configure a custom SMTP provider for your Supabase project
- If using the default provider, add the email to your organization team
- Configure your domain with SPF, DKIM, and DMARC records
- Test email sending with a simple auth request
const { error } = await supabase.auth.signUp({email: 'test@example.com',password: 'TestPassword123!',});if (error) {console.error('Sign up error:', error.message);} else {console.log('Sign up successful - check email for confirmation');}email_address_not_authorized: Email sending to this address is not authorized
What this error means
This error occurs when Supabase Auth attempts to send an email (signup confirmation, password reset, magic link, etc.) to an email address that is not authorized for your project. By default, Supabase only permits sending to email addresses that are members of your organization team to prevent spam and maintain the reputation of the default email sending service. The default SMTP provider has strict limitations to protect against abuse.
Typical symptoms
- Sign-up fails with 'email_address_not_authorized' error message
- Password reset emails cannot be sent to users
- Magic link authentication emails fail to send
- Error occurs even though the email address appears valid
- Works fine for team members but fails for external users
Common causes
- You are using Supabase's default SMTP email provider (not a custom SMTP server)
- The email address is not a member of your project's organization team
- Supabase Auth has rate limits and spam restrictions on the default provider
- The default provider only permits pre-authorized sender/recipient combinations
- Your project has not configured a custom SMTP service for unrestricted email sending
How to fix "email_address_not_authorized: Email sending to this address is not authorized"
The most reliable solution is to set up a custom SMTP server:
1. Go to your Supabase dashboard
2. Select your project and navigate to Project Settings → Auth → SMTP Settings
3. Toggle Enable Custom SMTP
4. Configure your SMTP credentials (host, port, username, password)
5. Set the sender email and sender name
6. Click Save
Recommended SMTP providers: Resend, Mailgun, SendGrid, Mailtrap, or AWS SES. Each offers free tiers to get started.
If you need to use Supabase's default SMTP temporarily, add the recipient email as a team member:
1. Go to Organization Settings → Team
2. Click Invite member
3. Enter the email address you want to send to
4. Send the invitation
5. Once accepted, that email will be authorized for receiving Auth emails
Note: This is only a temporary workaround. The default provider has a 2-4 messages per hour rate limit and is not suitable for production applications.
After setting up custom SMTP, improve email deliverability:
1. Access your domain's DNS settings (GoDaddy, Namecheap, AWS Route 53, etc.)
2. Add SPF record (usually looks like: v=spf1 include:provider.com ~all)
3. Add DKIM record (provided by your SMTP provider)
4. Add DMARC record (template: v=DMARC1; p=quarantine; rua=mailto:your-email@example.com)
5. Wait for DNS propagation (can take up to 48 hours)
6. Verify in your SMTP provider's dashboard that records are correctly configured
This ensures emails from your domain don't land in spam folders.
Once custom SMTP is configured, test it:
const { error } = await supabase.auth.signUp({
email: 'test@example.com',
password: 'TestPassword123!',
});
if (error) {
console.error('Sign up error:', error.message);
} else {
console.log('Sign up successful - check email for confirmation');
}Check your inbox (and spam folder) to confirm the email was received. If still failing, verify SMTP credentials are correct in Supabase settings.
Advanced notes
Rate Limits: Supabase's default SMTP provider has strict limits (2-4 emails/hour) due to spam abuse history. Custom SMTP providers typically offer much higher limits (hundreds or thousands per hour). Domain Reputation: For production apps, use separate sending domains for auth emails (auth.example.com) and marketing emails (marketing.example.com) to prevent reputation issues from affecting both. Google Workspace SMTP: If using Google Workspace SMTP, the sender email must match your admin email, and you must use an app-specific password (not your account password). Passwordless vs Password Auth: If using passwordless email-link auth, the email sending system is critical and must be properly configured before launch.
Frequently asked questions
- What does "email_address_not_authorized: Email sending to this address is not aut" mean?
- ) to an email address that is not authorized for your project. By default, Supabase only permits sending to email addresses that are members of your organization team to prevent spam and maintain the reputation of the default email sending service. The default SMTP provider has strict limitations to protect against abuse.
- How do I fix "email_address_not_authorized: Email sending to this address is not aut"?
- Supabase Auth restricts email sending to pre-authorized addresses when using the default email provider. This error occurs when trying to send authentication emails to addresses not in your project's authorized list.
- What causes "email_address_not_authorized: Email sending to this address is not aut"?
- You are using Supabase's default SMTP email provider (not a custom SMTP server) The email address is not a member of your project's organization team Supabase Auth has rate limits and spam restrictions on the default provider
- Is the "email_address_not_authorized: Email sending to this address is not aut" error serious?
- Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.