Description
Ensure the Confirm email setting is enabled for the Email provider, so that new users must click the confirmation link sent to their email address before they can sign in. This proves that the user actually owns the email address used to create the account.
Rationale
Without email confirmation, anyone can sign up using someone else's email address and start using the application straight away. This allows fake accounts, impersonation, spam, and abuse of features tied to email identity. Requiring confirmation makes sure each account belongs to a real person who controls the email address.
Impact
Users must confirm their email before signing in
Prevents sign-ups with email addresses the user does not own
Requires working email delivery, ideally through custom SMTP
Default Value
By default, Confirm email is enabled for projects on the hosted Supabase platform, but it can be turned off.
Pre-Requisites
Project Owner or Admin role
Working email delivery for auth emails
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Verify that Confirm email is enabled.
If it is disabled, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Enable Confirm email.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Disable Confirm email.
Select Save.
Reference