Auth Emails with Resend

This guide covers customizing Supabase Auth emails (sign up verification, magic link, password reset), connecting Resend for SMTP delivery, and applying deliverability best practices.

Overview

Supabase Auth sends three types of emails:

Email Type	Trigger	Purpose	Default Template
Confirmation Email	User signs up with email/password	Verify email address before first sign-in	Signup confirmation
Magic Link	User chooses passwordless sign-in	One-click authentication without password	Magic link
Password Reset	User clicks “Forgot password”	Secure password reset via email link	Reset password

All emails are sent via Supabase’s email service by default, but you can connect Resend (or any SMTP provider) for better deliverability, custom domains, and branded emails.

Prerequisites

Supabase project with Authentication enabled
(Recommended) Resend account with verified domain (SPF/DKIM/DMARC)

Configure URLs (Supabase)

Go to Supabase → Authentication → Configuration → URL Configuration and set:

Site URL (per environment)
Additional Redirect URLs: include /auth/callback for dev/preview/prod domains

Auth links in emails redirect to your app and complete the callback flow.

Connect Resend (SMTP)

Two options:

Option A: Use Supabase Integrations to connect Resend (auto SMTP configuration)
Option B: Get SMTP credentials from Resend and set them under Supabase → Authentication → Emails → SMTP Settings

Verify your domain in Resend (SPF, DKIM) before going live for proper deliverability.

Test emails from Supabase are delivered through Resend with your domain as sender.

Edit email templates (Supabase)

Go to Supabase → Authentication → Emails → Templates to edit subject, sender, and body for each email type.

Available Templates

Template	When Sent	Customizable Fields	Template Variables
Confirm signup	After email/password sign-up	Subject, Sender, HTML Body	`{{ .ConfirmationURL }}`, `{{ .SiteURL }}`, `{{ .Token }}`
Magic link	User requests passwordless sign-in	Subject, Sender, HTML Body	`{{ .ConfirmationURL }}`, `{{ .SiteURL }}`, `{{ .Token }}`
Change email address	User updates email in settings	Subject, Sender, HTML Body	`{{ .ConfirmationURL }}`, `{{ .SiteURL }}`, `{{ .Token }}`
Reset password	User clicks “Forgot password”	Subject, Sender, HTML Body	`{{ .ConfirmationURL }}`, `{{ .SiteURL }}`, `{{ .Token }}`

Template Variables

Each email template has access to these variables:

<!-- Main confirmation URL (includes token) -->
{{ .ConfirmationURL }}

<!-- Your site URL (from Supabase settings) -->
{{ .SiteURL }}

<!-- Raw token (for custom redirect URLs) -->
{{ .Token }}

<!-- Token hash (for OTP verification) -->
{{ .TokenHash }}

<!-- Email address (recipient) -->
{{ .Email }}

Example: Custom Magic Link Template

<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <title>Sign in to YourApp</title>
</head>
<body>
  <h1>Your magic link is ready</h1>
  <p>Click the button below to sign in to your account:</p>
  
  <a href="{{ .ConfirmationURL }}" style="...">
    Sign in to YourApp
  </a>
  
  <p>Or copy this link:</p>
  <code>{{ .ConfirmationURL }}</code>
  
  <p>This link expires in 1 hour.</p>
  
  <hr>
  <p>Didn't request this? You can safely ignore this email.</p>
</body>
</html>

Best practices for email templates:

Use clear, actionable subject lines (e.g., “Confirm your email” not “Action required”)
Include your logo and brand colors
Keep CTA buttons visible above the fold
Provide fallback text link in case button doesn’t render
Add expiration time (e.g., “This link expires in 1 hour”)
Include security disclaimer (e.g., “Didn’t request this? Ignore this email”)

Tracking links can break authentication:For Auth emails, disable link/open tracking in Resend or your SMTP provider. Tracking services rewrite URLs, which can break Supabase’s one-time magic links.How to disable tracking:

Resend: Go to Settings → Tracking → Disable for auth emails
SendGrid: Add tracking_settings.click_tracking.enable: false
Mailgun: Set o:tracking-clicks to no

Security scanner prefetch protection:Some corporate email security scanners automatically “click” links in emails to check for malware. This can consume one-time magic links before users click them.Solution: Implement an intermediate landing page:

Instead of direct magic link: https://yourapp.com/auth/callback?token_hash=...
Use intermediate page: https://yourapp.com/auth/verify?token=...
Show “Click to continue” button on intermediate page
Button then redirects to actual /auth/callback with token

This prevents scanners from consuming the real magic link.

Test each template by:

Triggering the email flow (sign up, magic link, password reset)
Checking inbox for email (also check spam)
Verifying links work correctly
Testing on multiple email clients (Gmail, Outlook, Apple Mail)

Deliverability best practices

Match the sender domain and link domain (use a custom domain)
Use a dedicated subdomain for auth emails (e.g., auth.yourdomain.com)
Disable tracking on Auth emails
Configure DMARC alongside SPF/DKIM
Mitigate link scanners with an intermediate page pattern

Emails land in inbox (not spam) for Gmail/Outlook; links function reliably.

End‑to‑end testing

Test all three email flows to ensure everything works:

1. Confirmation Email Test

Sign Up Flow
Email Not Received?

2. Magic Link Test

Magic Link Flow
Link Not Working?

Go to /sign-in
Enter email
Click “Send magic link” button
Expected: Magic link email arrives
Click link in email
Expected: Redirected to /dashboard
Verify you’re signed in

3. Password Reset Test

Reset Flow
Reset Issues?

Go to /forgot-password
Enter email
Submit form
Expected: Redirected to /sign-in?reset=true
Expected: Reset email arrives
Click link in email
Expected: Redirected to /reset-password
Enter new password
Submit form
Expected: Redirected to /sign-in
Sign in with new password

Common issues:

Email not received - Same debugging as confirmation email
Link expired - Reset links expire after 1 hour
Password not updated - Check for Supabase Auth Logs errors
Still using old password - Clear browser cache and try again

To verify reset worked:

# Check Supabase Auth Logs
Supabase Dashboard → Logs → Auth Logs → Look for "password_recovery" event

Testing Checklist

Email Flow Diagrams

User: /sign-up → Enter email/password → Submit
  ↓
Server: signUp() action → Supabase creates account
  ↓
Supabase: Sends confirmation email → {{ .ConfirmationURL }}
  ↓
User: Clicks link in email
  ↓
Browser: Opens /auth/callback?token_hash=...&type=signup
  ↓
Server: Verifies token → Creates session
  ↓
Browser: Redirects to /dashboard
  ↓
Result: User is signed in

Magic Link Flow

User: /sign-in → Enter email → Click "Send magic link"
  ↓
Server: signInWithMagicLink() action → Supabase sends OTP
  ↓
Supabase: Sends magic link email → {{ .ConfirmationURL }}
  ↓
User: Clicks link in email
  ↓
Browser: Opens /auth/callback?token_hash=...&type=email
  ↓
Server: Verifies OTP → Creates session
  ↓
Browser: Redirects to /dashboard
  ↓
Result: User is signed in

Password Reset Flow

User: /forgot-password → Enter email → Submit
  ↓
Server: sendResetEmail() action → Supabase sends recovery email
  ↓
Supabase: Sends reset email → {{ .ConfirmationURL }}
  ↓
User: Clicks link in email
  ↓
Browser: Opens /auth/callback?token_hash=...&type=recovery
  ↓
Server: Verifies token → Creates temporary session
  ↓
Browser: Redirects to /reset-password
  ↓
User: Enters new password → Submit
  ↓
Server: resetPassword() action → Updates password
  ↓
Browser: Redirects to /sign-in
  ↓
Result: Password updated

Troubleshooting

Emails not arriving

Cause: Rate limiting, spam filters, or SMTP misconfiguration.Fix:

Check rate limits:
- Supabase free tier: 4 emails/hour during development
- Production: Unlimited with verified domain
- Upgrade plan or wait for rate limit reset
Check spam folder:
- Auth emails often land in spam initially
- Use custom domain (not @resend.dev) to improve deliverability
Verify SMTP configuration:
- Supabase Dashboard → Auth → Emails → SMTP Settings
- Test connection with “Send test email” button
- Check Resend dashboard for delivery errors
Check Supabase logs:
- Dashboard → Logs → Auth Logs
- Look for email send errors
- Common error: “Email rate limit exceeded”

Links not working or showing 'auth_failed'

Cause: Expired links, already-used links, or tracking interference.Fix:

Check link expiration:
- Magic links: 1 hour (default)
- Reset links: 1 hour (default)
- Request new link if expired
Verify link hasn’t been used:
- Auth links are one-time use
- Already-clicked links show “auth_failed”
- Request new link
Disable email tracking:
- Resend → Settings → Tracking → Disable
- Link tracking rewrites URLs and breaks auth
Check for security scanner prefetch:
- Corporate emails may “click” links automatically
- Implement intermediate landing page pattern

Emails landing in spam

Cause: Poor sender reputation, no SPF/DKIM, or suspicious content.Fix:

Verify your domain in Resend:

# Add these DNS records
SPF: v=spf1 include:_spf.resend.com ~all
DKIM: [Resend provides unique DKIM record]
DMARC: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Use custom domain:
- Change from: noreply@resend.dev
- To: noreply@yourdomain.com or auth@yourdomain.com
Improve email content:
- Remove spammy words (“urgent”, “verify now”, excessive caps)
- Use clear, professional language
- Include your company logo and branding
Warm up your domain:
- Start with low email volume
- Gradually increase over days/weeks
- Monitor spam rates in Resend dashboard

Custom domain not working

Cause: DNS records not propagated or incorrectly configured.Fix:

Verify DNS records:

# Check SPF
dig TXT yourdomain.com | grep "v=spf1"

# Check DKIM
dig TXT resend._domainkey.yourdomain.com

# Check DMARC
dig TXT _dmarc.yourdomain.com

Wait for propagation:
- DNS changes can take 24-48 hours
- Use whatsmydns.net to check global propagation
Verify in Resend dashboard:
- Resend → Domains → Your domain should show “Verified”
- If not, re-check DNS records match Resend’s requirements
Test email sending:
- Resend → Domains → “Send test email”
- Check delivery to Gmail, Outlook, Yahoo

Email templates not rendering correctly

Cause: HTML/CSS compatibility issues across email clients.Fix:

Use email-safe HTML:
- Tables for layout (not CSS Grid/Flexbox)
- Inline CSS (not external stylesheets)
- Absolute URLs for images (not relative paths)
Test across clients:
- Litmus for email testing
- Email on Acid for preview
- Test manually in Gmail, Outlook, Apple Mail
Use Resend’s template testing:
- Resend → Templates → Preview
- Send test emails to yourself
- Check rendering on mobile devices
Simplify complex layouts:
- Email clients have limited HTML/CSS support
- Keep layouts simple and table-based
- Use web-safe fonts (Arial, Helvetica, Georgia)

Production Checklist

Before going live, ensure:

Custom domain verified in Resend (SPF/DKIM/DMARC configured)
Email templates customized with your branding
All template variables working correctly
Link tracking disabled for auth emails
Sender address uses your custom domain (auth@yourdomain.com)
Tested all three flows (confirmation, magic link, reset) end-to-end
Emails arrive within 1 minute
Emails don’t land in spam for Gmail/Outlook/Yahoo
Mobile email rendering tested
Dark mode email templates tested (if applicable)
Rate limits increased for production (Supabase plan upgrade)
Monitoring set up in Resend dashboard (delivery, bounces, complaints)

Auth with Supabase

Complete authentication setup including sign-in, sign-up, OAuth, and password reset flows.

Environment Variables

Configure Supabase and Resend environment variables for local and production.

API Reference: Auth Callback

Detailed documentation for the /auth/callback endpoint that handles email verification.

Resend Docs

Official Resend documentation for advanced email configuration and troubleshooting.

References

Supabase Dashboard (Auth → Emails → Templates): Open Dashboard
Supabase × Resend Integration: Integration
Deliverability guide: Resend Knowledge Base
DNS Record Checker: WhatsmyDNS
Email Testing Tools: Litmus, Email on Acid

Database with SupabaseWhere database types and clients live, how dashboard settings map to tables, and recommended usage patterns.

​Overview

​Prerequisites

​Available Templates

​Template Variables

​Example: Custom Magic Link Template

​1. Confirmation Email Test

​2. Magic Link Test

​3. Password Reset Test

​Testing Checklist

​Email Flow Diagrams

​Sign-Up Confirmation Flow

​Magic Link Flow

​Password Reset Flow

​Troubleshooting

​Production Checklist

​Related Documentation

Auth with Supabase

Environment Variables

API Reference: Auth Callback

Resend Docs

​References

Overview

Prerequisites

Available Templates

Template Variables

Example: Custom Magic Link Template

1. Confirmation Email Test

2. Magic Link Test

3. Password Reset Test

Testing Checklist

Email Flow Diagrams

Sign-Up Confirmation Flow

Magic Link Flow

Password Reset Flow

Troubleshooting

Production Checklist

Related Documentation

References