How to fix over_email_send_rate_limit: Email send rate limit exceeded in Supabase

Q: Is the "over_email_send_rate_limit: Email send rate limit exceeded" error serious?

It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

SupabaseINTERMEDIATEMEDIUMUpdated Dec 29, 2025· 425 views

This error occurs when your Supabase project exceeds its configured email sending rate limit. By default, the built-in email service allows only 2-4 emails per hour, while custom SMTP providers support 30+ emails per hour. Upgrading to a custom email provider or adjusting rate limits can resolve this.

Quick fix

Fixes over_email_send_rate_limit: Email send rate limit exceeded

// Add cooldown between signup attempts
const lastSignupAttempt = localStorage.getItem('lastSignupAttempt');
const now = Date.now();
const cooldown = 60000; // 1 minute between attempts

if (lastSignupAttempt && now - parseInt(lastSignupAttempt) < cooldown) {
  throw new Error('Please wait before trying again');
}

try {
  await supabase.auth.signUp({ email, password });
  localStorage.setItem('lastSignupAttempt', now.toString());
} catch (error) {
  // Handle error
}

Check your current email service configuration
Set up a custom SMTP provider
Configure rate limits for your email service
Implement client-side rate limiting

supabase — error

$// Add cooldown between signup attempts
const lastSignupAttempt = localStorage.getItem('lastSignupAttempt');
const now = Date.now();
const cooldown = 60000; // 1 minute between attempts
if (lastSignupAttempt && now - parseInt(lastSignupAttempt) < cooldown) {
  throw new Error('Please wait before trying again');
}
try {
  await supabase.auth.signUp({ email, password });
  localStorage.setItem('lastSignupAttempt', now.toString());
} catch (error) {
  // Handle error
}
over_email_send_rate_limit: Email send rate limit exceeded

What this error means

Supabase Auth enforces rate limits on email sending to prevent abuse and protect service reputation. When your application attempts to send more emails than the configured limit allows within a time window, the `over_email_send_rate_limit` error is returned. This typically happens during user registration flows when multiple users sign up quickly, or when resending verification emails. The limit applies to all auth emails including sign-up confirmations, password resets, and OTP codes.

Typical symptoms

User registration fails with '429: Email rate limit exceeded' error
Password reset emails cannot be sent during peak usage
Magic link authentication requests are rejected
OTP code delivery fails intermittently
Error only occurs during high-traffic periods or batch operations
Failed signup attempts still count against the rate limit

Common causes

Using Supabase's built-in email service which has a very low rate limit (2-4 emails/hour) intended only for development
Custom SMTP provider rate limit of 30 emails/hour exceeded due to high user registration volume
Failed authentication attempts still consume rate limit quota even though no email is sent
Resending verification codes or password reset emails within the rate limit window
Attempting to invite multiple users from the Supabase dashboard simultaneously
Production application using the default email service instead of custom SMTP

How to fix "over_email_send_rate_limit: Email send rate limit exceeded"

1Check your current email service configuration

Navigate to your Supabase project dashboard and go to Settings > Auth > Email. Verify which email provider you are currently using:
- Built-in SMTP: Limited to 2-4 emails per hour (development only)
- Custom SMTP: Can handle 30+ emails per hour

If you are in production, you should be using a custom SMTP provider.

2Set up a custom SMTP provider

Configure a custom email service to replace the built-in provider. Popular options include:

AWS SES (Recommended for scale)
1. Sign up for AWS SES and verify your sending domain
2. Generate SMTP credentials in AWS console
3. In Supabase Settings > Auth > Email, select "Custom SMTP"
4. Enter your AWS SES SMTP endpoint and credentials

SendGrid (Easy to set up)
1. Create a SendGrid account at sendgrid.com
2. Generate an API key with mail send permissions
3. In Supabase, select Custom SMTP
4. Use smtp.sendgrid.net as host, port 587, with API key as password

Resend (Purpose-built for transactional email)
1. Sign up at resend.com
2. Generate an API key
3. Use their SMTP endpoint in Supabase custom SMTP settings

Other options: Mailgun, Postmark, Brevo, or your own mail server

3Configure rate limits for your email service

After setting up custom SMTP, adjust the rate limits to match your application's needs:

1. In Supabase dashboard, go to Auth > Rate Limits
2. Find the "Email send rate limit" setting (default is 30 emails/hour for custom SMTP)
3. Increase it based on your expected user registration patterns
4. If you expect a major traffic spike, contact Supabase support at least 2 weeks in advance

Example configurations:
- Small app (< 100 users/day): Keep at 30 emails/hour
- Medium app (100-1000 users/day): Set to 100-200 emails/hour
- Large app: Request higher limits from Supabase support

4Implement client-side rate limiting

Reduce pressure on email sending by adding client-side controls:

javascript

// Add cooldown between signup attempts
const lastSignupAttempt = localStorage.getItem('lastSignupAttempt');
const now = Date.now();
const cooldown = 60000; // 1 minute between attempts

if (lastSignupAttempt && now - parseInt(lastSignupAttempt) < cooldown) {
  throw new Error('Please wait before trying again');
}

try {
  await supabase.auth.signUp({ email, password });
  localStorage.setItem('lastSignupAttempt', now.toString());
} catch (error) {
  // Handle error
}

Also implement exponential backoff for resend attempts:

javascript

async function resendVerificationWithBackoff(email, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      await supabase.auth.resend({ email });
      return;
    } catch (error) {
      if (error.status === 429) {
        // Wait before retrying: 2s, 4s, 8s
        await new Promise(r => setTimeout(r, Math.pow(2, i + 1) * 1000));
      } else {
        throw error;
      }
    }
  }
}

5Monitor and optimize email sending patterns

Keep track of your email sending to prevent future rate limit issues:

1. Log email operations: Track successful sends and rate limit hits in your application logs
2. Use Supabase Analytics: Monitor authentication metrics in your project dashboard
3. Set up alerts: Create alerts when rate limit errors exceed a threshold
4. Batch operations carefully: If sending bulk invitations, space them out over time instead of sending all at once
5. Review failed attempts: Failed signups still consume rate limit quota, so validate inputs on the client before submission

Example monitoring code:

typescript

try {
  await supabase.auth.signUp({ email, password });
} catch (error) {
  if (error.message.includes('rate limit')) {
    // Log to monitoring service
    console.error('Rate limit hit', { timestamp: new Date(), email });
    // Show user a friendly message
  }
}

Advanced notes

For self-hosted Supabase, use the environment variable GOTRUE_RATE_LIMIT_EMAIL_SENT to configure the rate limit. The rate limit is applied per project and is shared across all authentication methods (sign-up, password reset, magic links, OTP). When testing, be aware that failed authentication attempts count against your quota even if no email is actually delivered. Set up DKIM, DMARC, and SPF records for your custom SMTP domain to improve email deliverability. Supabase's built-in email service provides no SLA and is explicitly not recommended for production use.

Frequently asked questions

What does "over_email_send_rate_limit: Email send rate limit exceeded" mean?: Supabase Auth enforces rate limits on email sending to prevent abuse and protect service reputation. When your application attempts to send more emails than the configured limit allows within a time window, the over_email_send_rate_limit error is returned. This typically happens during user registration flows when multiple users sign up quickly, or when resending verification emails.
How do I fix "over_email_send_rate_limit: Email send rate limit exceeded"?: This error occurs when your Supabase project exceeds its configured email sending rate limit. By default, the built-in email service allows only 2-4 emails per hour, while custom SMTP providers support 30+ emails per hour. Upgrading to a custom email provider or adjusting rate limits can resolve this.
What causes "over_email_send_rate_limit: Email send rate limit exceeded"?: Using Supabase's built-in email service which has a very low rate limit (2-4 emails/hour) intended only for development Custom SMTP provider rate limit of 30 emails/hour exceeded due to high user registration volume Failed authentication attempts still consume rate limit quota even though no email is sent
Is the "over_email_send_rate_limit: Email send rate limit exceeded" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Supabase Official Documentation