Notify users about security-sensitive actions on their accounts

[fadymak]

Letting users know about security-sensitive actions on their account is an increasingly common authentication feature.

We’re excited to announce an expansion of our email templates to handle these these types of events, beginning with:

• Password changed
• Email changed
• Phone number changed
• Identity linked or unlinked
• Multi-factor authentication enrolled or unenrolled

You can find documentation—including for our API—here. The list of templates will continue to grow as our feature-set changes, and as we gather feedback from our community.

Note

To enable the feature preview, click your profile avatar, click Feature previews and enable Security notification templates.

What we’d like to know from you

• Any bugs or issues you run into when using email templates
• Any friction you run into when managing email templates through the Supabase dashboard
• Any additional use cases for email templates, and how we might be able to better support your workflow

Rollout plan

• Changes are behind a feature preview in the dashboard
• Starting from 13th Nov 2025, we will roll out to the hosted platform first as incremental % rollout where users will be opted into the feature preview by default
• If you might want opt out of the changes, you may disable the changes via the feature previews which you can access through the user dropdown in the header here:

Related links

• Dashboard: https://supabase.com/dashboard/project/_/auth/templates
• Documentation:
  • Email templates: https://supabase.com/docs/guides/auth/auth-email-templates
  • Send email hook: https://supabase.com/docs/guides/auth/auth-hooks/send-email-hook
  • Local Dev / CLI: https://supabase.com/docs/guides/local-development/customizing-email-templates

[KrunchMuffin]

Found one bug: if you update the template, don't save, and then go click "Enable" and save, it reverts to the previous template

[dnywh]

Thanks for letting us know @KrunchMuffin! We’ll put out a fix shortly.

[dnywh]

#44886

[ADVITECHANDTRAVEL]

Add A Account Violation And Suspendation Email Template Keep It Up Supabase.

[NormanL]

These updates are GREATLY appreciated. Super useful. One scenario that myself, and others, struggle with is for a welcome scenario - when a user is confirmed. There are some weird situations you can get into when using different login methods. Do we use an Auth Hook, or a DB Trigger, or something else? It would be great if we had a template for "User Confirmed".
Anyways, keep up the great work!

[dnywh]

Thanks @NormanL!

That’s a good question as there are a few ways you could do it (and something I want to build for my own side projects). It’s also a design question. I.e. do you want to send a welcome email immediately after sign-up or when a user has done something meaningful on your app?

The former (user row created/confirmed) could just be done via a trigger against auth.users. The latter (meaningful) could be an edge function that runs after whatever you determine as “meaningful”, e.g. sent their first message. I’d track it in a table like welcome_sent_at.