auth.email.double_confirm_changes not working

[maximilian-hammerl]

Describe the bug

The auth.email.double_confirm_changes configuration option (https://supabase.com/docs/guides/local-development/cli/config#auth.email.double_confirm_changes) in the config.toml does not seem to work.

To Reproduce

Repository: https://github.com/maximilian-hammerl/supabase-change-email-address-bug

After starting both Supabase (npm run start, and optionally npm run serve) and the frontend (npm install and npm run dev), open http://localhost:5173/

Then:

1. One the first screen click on "Register and login" (e-mail address and password are randomly generated)
2. On the second screen, request the change e-mail address links
3. On the third screen, click on any of the two links, then on "Reload user and display current e-mail address" and check that the current e-mail address has now changed to the requested e-mail address, although you only clicked on one of the two links

Expected behavior

The e-mail address of the user should only change after the user clicked on both links, not just one of them.

System information

• Version of OS: macOS 15.0.1
• Version of CLI: v1.207.9
• Version of Docker: v4.34.3
• Versions of services:

        SERVICE IMAGE      │      LOCAL       │ LINKED
  ─────────────────────────┼──────────────────┼─────────
    supabase/postgres      │ 15.1.1.78        │ -
    supabase/gotrue        │ v2.158.1         │ -
    postgrest/postgrest    │ v12.2.0          │ -
    supabase/realtime      │ v2.30.34         │ -
    supabase/storage-api   │ v1.11.13         │ -
    supabase/edge-runtime  │ v1.59.0          │ -
    supabase/studio        │ 20241014-c083b3b │ -
    supabase/postgres-meta │ v0.84.2          │ -
    supabase/logflare      │ 1.4.0            │ -
    supabase/supavisor     │ 1.1.56           │ -

Additional context

• Browser: Firefox v132.0b9
• Version of supabase-js: v2.45.6
• Version of Node.js: v22.10.0

---

We also contacted the Supabase support regarding this issue (Support ticket ID: 15644055709), because we first assumed that it was not a bug, but an issue on our side, but received two less than helpful answers (telling us to use updateUser to change the e-mail address of the user, completely disregarding that we want the user to confirm the e-mail address change, as well as forgetting and repeatedly asking where we set the double_confirm_changes configuration option).

[maximilian-hammerl]

I created a test Supabase instance with project ID djigzxpjteusflninqtt, enabled "secure email change"

and I am still able to reproduce this issue.

This bug seems to affect a locally running as well as a hosted Supabase instance.

[avallete]

Hey there ! Thank's for reporting and taking the time to make a MRE that's very helpful !

Seems like this might be a bug with the generateLink used to generate the mail links. After some testing the bug doesn't happen if you just "updateUser" and change it's mail. In such case, both adresses of the users receive an email, and both links need to be clicked to confirm the change.

I've pinged our auth team to have a look at it. I'm transferring the issue over the appropriate repo.

[maximilian-hammerl]

Hi, what is the status of this issue? Are you already working on it?

[Coop4Free]

Same problem here

[silentworks]

I've tested the demo you've provided and cannot replicate the issue you seem to be having. I'm using all the same versions of everything you provided in your example and double_confirm_email is working as expected. The email doesn't change until both links are clicked.

supabase_secure_email_change.mp4

[SkeltalFlamingo]

I'm experiencing this issue in local development too.
In config.toml I have:
double_confirm_changes = true
enable_confirmations = false

and when using
const { error: authError } = await supabase.auth.updateUser( { email: data.email, }, { emailRedirectTo } );

Clicking either one of the emailed links allows the email change. Despite having double_confirm_changes = true, the user doesn't need to click both links to change their email. Any solution would be appreciated!

[beanamancer]

Reproducing on hosted Supabase (not just local dev), in case that disambiguates against the "can't reproduce" report above.

Environment

• Hosted Supabase project: tukrxsgxazzdwwbuavkf
• Dashboard → Authentication → Providers → Email → "Secure email change" toggle: ON (screenshot-verified)
• Client: @supabase/ssr in a Next.js App Router app calling auth.updateUser({ email: newEmail }) from a Server Action

Symptom (matches OP's report)

Both emails arrive at old and new addresses. Clicking either confirmation link commits the email change on the first click. The second link returns 303 + 403 "One-time token not found".

Auth log evidence (2026-05-10 00:30 UTC)

00:29:48  mail.send to old@…   (mail_type: email_change)
00:29:48  mail.send to new@…   (mail_type: email_change)
00:30:09  GET /verify  303     action: user_modified   ← committed on FIRST click
00:30:50  GET /verify  303 + 403 "One-time token not found"  ← second click

Observed behavior matches the toggle's disabled state, not the enabled state.

App-side workaround

Updated success copy + dialog description to reflect single-confirm reality. Will revert when this lands.

Happy to provide additional reproduction details (HAR, network captures, redirect chain) if useful. Thanks for tracking.

[unkn-wn]

Also facing this issue, on hosted Supabase environment. Secure email change is on, config.toml has double_confirm_changes = true. And I only have to click on one email's link to get the email change to go through.

[silentworks]

It looks like this got reverted since when I tested it more than a year ago. I tested it again today with the latest version of the CLI and notice the behavior isn''t the same as what I recorded in my video in 2025.