How to fix sms_send_failed: Sending SMS failed in Supabase

First, verify that SMS is properly configured in your Supabase project:

1. Go to your Supabase Dashboard → Authentication → Providers
2. Scroll to the "Phone" section
3. Ensure "Enable phone sign-in" is toggled ON
4. Check that you have a valid SMS provider configured (Twilio, MessageBird, etc.)
5. Verify API keys, account SID, and auth tokens are correct and not expired

If using Twilio, ensure your Twilio account has sufficient credits and the phone number is verified for sending SMS.

Ensure phone numbers are in the correct international format:

// Correct format: +[country code][number]
const validNumber = '+14155552671'; // US number
const invalidNumber = '4155552671'; // Missing country code

// In Supabase client:
const { error } = await supabase.auth.signInWithOtp({
  phone: '+14155552671', // Must include country code
})

Common issues:
- Missing "+" prefix
- No country code (e.g., using local format like "4155552671" instead of "+14155552671")
- Invalid country code
- Number not supported by your SMS provider

SMS providers impose rate limits and require sufficient credits:

1. Check your SMS provider dashboard:
- Twilio: Check "Usage" and "Balance" in Console
- MessageBird: Check "Balance & Top-up" section
- Other providers: Verify account has positive balance

2. Review rate limits:
- Supabase has default rate limits for SMS sending
- SMS providers have their own rate limits per number/account
- Check if you've exceeded daily/monthly SMS quotas

3. For development/testing:
- Use test credentials or sandbox mode if available
- Consider using mock SMS services for development
- Use phone numbers verified in your SMS provider account

Test SMS delivery with a phone number you control and have verified with your SMS provider:

// Test with a known working number
async function testSmsDelivery() {
  const { data, error } = await supabase.auth.signInWithOtp({
    phone: '+14155552671', // Your verified test number
    options: {
      channel: 'sms'
    }
  });

  if (error) {
    console.error('SMS test failed:', error.message);
    // Check error.code for specific error details
    if (error.code === 'sms_send_failed') {
      console.log('SMS provider configuration issue');
    }
  } else {
    console.log('SMS sent successfully');
  }
}

If this works but production numbers fail, the issue may be with specific numbers being blocked or unsupported.

Examine detailed error information in Supabase logs:

1. Check Supabase Dashboard logs:
- Go to Project → Authentication → Logs
- Filter for "sms_send_failed" errors
- Look for additional error details or provider-specific error codes

2. Client-side error inspection:

const { error } = await supabase.auth.signInWithOtp({
  phone: phoneNumber,
  options: { channel: 'sms' }
});

if (error) {
  console.error('Full error object:', error);
  console.error('Error code:', error.code); // Should be "sms_send_failed"
  console.error('Error status:', error.status); // HTTP status code
  console.error('Error message:', error.message);
}

3. Common associated errors:
- over_sms_send_rate_limit - Too many SMS sent to this number
- validation_failed - Phone number validation failed
- Provider-specific errors from Twilio/MessageBird etc.

As a contingency plan, provide alternative authentication methods:

// Offer email fallback if SMS fails
async function authenticateWithFallback(phoneNumber, email) {
  try {
    // Try SMS first
    const { error } = await supabase.auth.signInWithOtp({
      phone: phoneNumber,
      options: { channel: 'sms' }
    });

    if (error && error.code === 'sms_send_failed') {
      console.warn('SMS failed, falling back to email');

      // Fallback to email OTP
      const { error: emailError } = await supabase.auth.signInWithOtp({
        email: email
      });

      if (emailError) {
        throw new Error('Both SMS and email failed: ' + emailError.message);
      }

      return { success: true, method: 'email' };
    }

    return { success: true, method: 'sms' };
  } catch (err) {
    console.error('Authentication failed:', err);
    return { success: false, error: err.message };
  }
}

Also consider implementing:
- Magic link authentication as backup
- Social providers (Google, GitHub) as alternatives
- Temporary bypass codes for critical users