Supabase says the auth rate limit was exceeded. Here is why.
Supabase Auth ships with built-in abuse limits, and the one that surprises the most people is email: 2 per hour on the shared mailer that comes with every new project, meant for testing only, not for real signups.
Last checked October 12, 2026.
The default limits
| What | Default | Can custom SMTP raise it? |
|---|---|---|
| Emails (signup, recovery, user) on the built-in mailer | 2 per hour | Yes — default becomes 30 new users per hour, and is configurable from there |
| One-time passwords (OTP) | 360 per hour | Configurable |
| OTP / magic link / signup / recovery request window | 60 seconds between requests | No, fixed |
| Token refresh | 1,800 per hour (bursts to 30) | Not applicable |
| Verification requests | 360 per hour (bursts to 30) | Not applicable |
| Anonymous sign-ins | 30 per hour (bursts to 30) | Not applicable |
| MFA challenge/verify | 15 per minute (bursts to 30) | Not applicable |
Why this shows up in development, not just under attack
The built-in mailer's 2-emails-per-hour cap exists because it is a shared, unauthenticated service meant for trying Supabase out, not for sending real signup confirmations. A handful of test signups during onboarding is enough to hit it, which reads as a bug the first time it happens.
The fix: custom SMTP before launch
Step 1
Add a custom SMTP provider
In the dashboard under Authentication → Settings → SMTP Settings, point Supabase at your own transactional email provider (Resend, Postmark, SES, or similar) instead of the built-in mailer.
Step 2
Re-check the limit
With custom SMTP configured, the default email rate limit becomes 30 new users per hour, and from there it is configurable in Authentication → Rate Limits to match what your provider allows.
Auth email on Scribase
Scribase Auth sends through Scribase Mail (a Resend-compatible API) from the first signup, so there is no shared-mailer cap to hit before launch and no separate SMTP provider to wire up.
Sources: Scribase Mail
Questions people ask
How many signup emails can Supabase send per hour by default?
Two, on the built-in mailer every new project starts with. Adding custom SMTP raises the default to 30 new users per hour, and that number is then configurable.
Does the auth rate limit reset or do I have to wait?
It is a rolling hourly window; once enough of the hour has passed since the oldest counted request, capacity frees up. There is no manual reset switch for the built-in limits.
Is the OTP rate limit the same as the email rate limit?
No. OTP requests have their own 360-per-hour allowance and a 60-second window between requests; they share a budget with magic links and recovery emails sent as OTPs.