# Ensure email confirmation is required before sign-in

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103905364403-ensure-email-confirmation-is-required-before-sign-in
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Confirm email setting is enabled for the Email provider, so that new users must click the confirmation link sent to their email address before they can sign in. This proves that the user actually owns the email address used to create the account.

**Rationale**

Without email confirmation, anyone can sign up using someone else's email address and start using the application straight away. This allows fake accounts, impersonation, spam, and abuse of features tied to email identity. Requiring confirmation makes sure each account belongs to a real person who controls the email address.

**Impact**

-   Users must confirm their email before signing in
    
-   Prevents sign-ups with email addresses the user does not own
    
-   Requires working email delivery, ideally through custom SMTP
    

**Default Value**

By default, Confirm email is enabled for projects on the hosted Supabase platform, but it can be turned off.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   Working email delivery for auth emails
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Verify that Confirm email is enabled.
    
5.  If it is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Enable Confirm email.
    
5.  Select Save.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Disable Confirm email.
    
5.  Select Save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/passwords](https://supabase.com/docs/guides/auth/passwords)
    
-   [https://supabase.com/docs/guides/deployment/going-into-prod](https://supabase.com/docs/guides/deployment/going-into-prod)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.