Supabase Auth API error codes, explained
Supabase Auth returns a stable error.code on every failed request, separate from the human-readable message, so your code should branch on the code — the message text can change between SDK versions.
Last checked October 12, 2026.
Check error.code, not the message
Every Auth API error carries a stable code string and an error name, both documented, alongside a message meant for humans. Supabase's own guidance is to match on code (or name), never on the message text, since wording can change across SDK versions while the code stays stable.
const { error } = await supabase.auth.signUp({ email, password });
if (error?.code === 'weak_password') {
// show a password-strength hint
} else if (error?.code === 'email_exists') {
// offer sign-in instead
}Sources: Supabase: Auth error codes
Codes worth branching on
| Code | Meaning |
|---|---|
| weak_password | The password does not meet the configured strength rules on signup or password change. |
| email_exists | That email address already has an account. |
| over_email_send_rate_limit | Too many emails sent to this address; the user should wait before retrying (see the rate-limit guide for the exact window). |
| user_not_found | The user the request refers to no longer exists. |
| email_not_confirmed | Sign-in is refused because the email address has not been confirmed yet. |
Sources: Supabase: Auth error codes
Typical HTTP status alongside the code
- 422 for requests the API understands but cannot complete given the current user or server state, including weak_password and email_exists.
- 429 for rate-limit codes such as over_email_send_rate_limit.
- 400 for malformed requests that fail before reaching a specific business-logic code.
Sources: Supabase: Auth error codes
On Scribase
Scribase Auth answers the same supabase-js client and the same error.code field, so code written against these codes keeps working after a move.
Sources: Scribase pricing
Questions people ask
Should I match on error.message or error.code?
error.code (or error.name). The message is written for humans and can change; the code is the stable contract.
What does over_email_send_rate_limit mean?
The address has received too many emails recently and Auth is refusing to send another until the rate-limit window allows it.
Is there one error code reference for both Auth and Postgres errors?
No. Auth API codes (like weak_password) are GoTrue's own codes; Postgres errors surfaced through PostgREST carry a five-character SQLSTATE, documented separately on the Postgres error codes reference.