How to fix over_sms_send_rate_limit: SMS send rate limit exceeded in Supabase

// Client-side rate limiting for SMS requests
let lastSmsRequestTime = 0;
const SMS_COOLDOWN_MS = 60000; // 60 seconds between requests

async function requestSmsOtp(phoneNumber) {
  const now = Date.now();
  const timeSinceLastRequest = now - lastSmsRequestTime;

  if (timeSinceLastRequest < SMS_COOLDOWN_MS) {
    const remainingSeconds = Math.ceil((SMS_COOLDOWN_MS - timeSinceLastRequest) / 1000);
    throw new Error(`Please wait ${remainingSeconds} seconds before requesting another code`);
  }

  lastSmsRequestTime = now;

  const { error } = await supabase.auth.signInWithOtp({
    phone: phoneNumber,
    options: { channel: 'sms' }
  });

  if (error) {
    if (error.code === 'over_sms_send_rate_limit') {
      // Show user-friendly message with longer cooldown
      return {
        success: false,
        message: 'Too many attempts. Please wait 5 minutes before trying again.',
        cooldown: 300000 // 5 minutes
      };
    }
    throw error;
  }

  return { success: true, message: 'SMS sent successfully' };
}

// Using reCAPTCHA v3 with Supabase
async function sendSmsWithCaptcha(phoneNumber) {
  // Get reCAPTCHA token
  const token = await grecaptcha.execute('YOUR_SITE_KEY', {action: 'sms_request'});

  // Verify token with your backend
  const captchaValid = await verifyCaptchaToken(token);

  if (!captchaValid) {
    throw new Error('CAPTCHA verification failed');
  }

  // Proceed with SMS request
  const { error } = await supabase.auth.signInWithOtp({
    phone: phoneNumber,
    options: { channel: 'sms' }
  });

  return { error };
}

// Alternative: hCaptcha or Turnstile
async function sendSmsWithTurnstile(phoneNumber) {
  const token = await turnstile.execute('YOUR_WIDGET_ID');

  const response = await fetch('/api/verify-turnstile', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ token })
  });

  if (!response.ok) {
    throw new Error('Bot protection verification failed');
  }

  const { error } = await supabase.auth.signInWithOtp({
    phone: phoneNumber,
    options: { channel: 'sms' }
  });

  return { error };
}

// Log rate limit events for analysis
async function handleSmsError(error, phoneNumber, context) {
  const logEntry = {
    timestamp: new Date().toISOString(),
    errorCode: error.code,
    errorMessage: error.message,
    phoneNumber: maskPhoneNumber(phoneNumber), // Mask for privacy
    context: context,
    userAgent: navigator.userAgent,
    ipAddress: await getClientIp() // From your backend
  };

  // Send to analytics service
  await fetch('/api/log/sms-error', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(logEntry)
  });

  // Check Supabase logs for more details
  console.warn('SMS rate limit triggered:', {
    phoneNumber: maskPhoneNumber(phoneNumber),
    time: new Date().toISOString(),
    errorDetails: error
  });
}

// Check Supabase Dashboard for logs:
// 1. Go to Project → Authentication → Logs
// 2. Filter for "over_sms_send_rate_limit" events
// 3. Look for patterns:
//    - Same IP address making many requests
//    - Same phone number receiving excessive SMS
//    - Time-based patterns indicating automated attacks

// Multi-method authentication with fallbacks
async function authenticateUser(identifier, method = 'auto') {
  try {
    if (method === 'sms' || method === 'auto') {
      const { error } = await supabase.auth.signInWithOtp({
        phone: identifier,
        options: { channel: 'sms' }
      });

      if (!error) return { success: true, method: 'sms' };

      if (error.code === 'over_sms_send_rate_limit') {
        console.warn('SMS rate limited, trying email fallback');
        // Check if identifier could be an email
        if (identifier.includes('@')) {
          return await authenticateUser(identifier, 'email');
        }
        // Offer alternative methods
        return {
          success: false,
          method: 'sms',
          error: 'SMS rate limited. Please try again in 5 minutes or use email authentication.',
          fallbacks: ['email', 'magic_link']
        };
      }
    }

    if (method === 'email' || method === 'auto') {
      const { error } = await supabase.auth.signInWithOtp({
        email: identifier
      });

      if (!error) return { success: true, method: 'email' };
    }

    // Magic link fallback
    if (method === 'magic_link') {
      const { error } = await supabase.auth.signInWithOtp({
        email: identifier,
        options: {
          emailRedirectTo: 'https://yourapp.com/auth/callback'
        }
      });

      if (!error) return { success: true, method: 'magic_link' };
    }

    throw new Error('All authentication methods failed');

  } catch (err) {
    console.error('Authentication failed:', err);
    return { success: false, error: err.message };
  }
}

// Cache successful authentications to reduce SMS volume
const smsCache = new Map();

async function getCachedSmsAuth(phoneNumber) {
  const cacheKey = `sms-auth:${phoneNumber}`;
  const cached = smsCache.get(cacheKey);

  if (cached && Date.now() - cached.timestamp < 300000) { // 5 minute cache
    return { cached: true, data: cached.data };
  }

  // Remove expired entries
  for (const [key, value] of smsCache.entries()) {
    if (Date.now() - value.timestamp > 300000) {
      smsCache.delete(key);
    }
  }

  return { cached: false };
}

// Implement resend logic with increasing delays
async function resendSmsOtp(phoneNumber, attempt = 1) {
  const baseDelay = 60000; // 60 seconds
  const maxDelay = 300000; // 5 minutes
  const delay = Math.min(baseDelay * Math.pow(2, attempt - 1), maxDelay);

  if (attempt > 3) {
    throw new Error('Maximum resend attempts reached. Please contact support.');
  }

  await new Promise(resolve => setTimeout(resolve, delay));

  const { error } = await supabase.auth.signInWithOtp({
    phone: phoneNumber,
    options: { channel: 'sms' }
  });

  return { error, nextAttemptDelay: Math.min(delay * 2, maxDelay) };
}

// Usage
const result = await resendSmsOtp('+1234567890', 1);
if (result.error && result.error.code === 'over_sms_send_rate_limit') {
  console.log(`Next attempt available in ${result.nextAttemptDelay / 1000} seconds`);
}