Hi! I think I’ve hit a bug with password recovery links on my hosted project.

[PhilippeReynaud38]

Hi! I think I’ve hit a bug with password recovery links on my hosted project.

Project ref: cnjjibjmaeswdxooogvm
App: keefon.com (Next.js on Vercel)

For every password recovery email, clicking the link immediately returns:

{"code":403,"error_code":"otp_expired","msg":"Email link is invalid or has expired"}

even when:

I click the link within a few seconds

Email OTP Expiration is set to 720 seconds

Site URL = https://keefon.com

https://keefon.com/reset-password is in the Redirect URLs

The same flow works locally on http://localhost:3000/reset-password, but not on the hosted domain.
Is this a known issue, or is there something else I should check on this project?

[pragatidh]

If the reset link keeps expiring instantly on ur live site but works locally it’s usually a tiny URL mismatch make sure ur site URL and redirect URL match ur Vercel domain exactly with the right https and no extra slashes even a small difference can make the OTP look expired

[VladTkDev]

On the URL theory above: Site URL and Redirect URLs decide where the browser lands after the check, and otp_expired comes from the check itself. Auth's verify code returns it when no waiting token matches the link, or when the match is older than your expiry. Seconds after sending, the token had already been used or replaced.

Supabase's otp_expired troubleshooting page calls email prefetching "the most common reason for OTP tokens appearing expired or invalid before a user can even use them": security tools open links in incoming mail to check them, and the first visit spends the token. To confirm it, that page says to match 403s on /verify in the API logs against otp_expired in the Auth logs, by time and IP.

On Next.js, check the reset template too: Supabase's PKCE recipe links to /auth/confirm?token_hash=...&type=recovery and calls verifyOtp in a GET route handler, so a scanner opening that address spends it the same way.

The fix is a Reset password template where opening the link does nothing: send {{ .Token }} for the person to type into a page that calls verifyOtp({ email, token, type: 'recovery' }), or call verifyOtp({ token_hash, type: 'recovery' }) only when they press a button. A longer expiry changes nothing, since the scanner gets there first.

If "locally" means the CLI stack, that explains the difference: its emails go to Mailpit, and nothing opens them first.

I wrote up the other causes and how to tell them apart: https://reeve.page/blog/email-link-is-invalid-or-has-expired