OTP expiration setting vs Email invite expiration

[SebasScript]

Is it possible to set the expiration time of an email invite separate from the OTP time? As of right now they booth can be changed in the dashboard under the auth email settings. For security reasons it is good to have the OTP time limited. But this wont work for an invitiation email to a new user which could take a couple hours or days to be used.

[matejm]

This would be amazing. Setting OTP time to 1 day (maximum) seems a bit too long for normal expiration time (as Supabase also shows in web interface), but is still quite low for invite duration.

[amit-timalsina]

Facing the same issue. We should be able to provider longer time for email invitation. In my case, we invite the user to join an account after we have setup a project and we send invite to join the account and get invitation.

[Droces]

I have the same issue. Need to send invites that last a few days (let's say 5 days), but OTPs should expire after 5 minutes as default. So these need to be separate values.

[pserena-iterpro]

Same here. I'm using passwordless-based login (with both OTP and Magic Link) + Invitation email with Magic Link.
I think this should be a priority because it disrupts the UX of everyone using this flow.

I could just increase the expiration period to 72 hours for both login and invite OTP/Magic Link, but that would be a bad security choice.
I could just deactivate the "confirm email" setting, but that would be a bad UX choice.

Please @hf, @kangmingtay, @GaryAustin1 (found you as the most active contributors for supabase/auth), consider this as an important request.

[JoshSnider]

Another ping here, let’s see some action on the basics for passwordless Auth! Should be a couple hour ticket at most.

[ccczy-czy]

Any update on this? Also would like something that can set separate expiration time for OTP and invite link.

[Zanderinos]

+1, still running into this in 2026.

Right now I have to pick one otp_expiry for both invites and password resets. Bump it to 24h so invites actually work, and now every password reset link is valid for a day too, which isn't great. Keep it at an hour for security and invites are basically unusable.

A per-template expiry would fix this. Even just a separate one for invites would cover most cases. Is this on the roadmap at all, or is there a recommended way to work around it?

[budokans]

Also running into this, would be really nice to have for invites.