Email rate limit exceeded for all auth requests

[rmrt1n]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Inviting users from the Supabase dashboard and/or sign-up/sign-in using the client sdk results in the error 429: Email rate limit exceeded. This occurs when using new emails as well.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Send invitation to user from Supabase dashboard
2. See notification of error 429

Expected behavior

The rate limit shouldn't be exceeded.

Screenshots

System information

• OS: [Linux]
• Browser (if applies) [e.g. firefox]
• Version of supabase-js: [e.g. 2.26.0]
• Version of Node.js: [e.g. 16.15.1]

Additional context

A lot of users seem to have this issue too #10850.

[GaryAustin1]

The signup rate was evidently lowered to 4/hour for the built in SMTP service. You should not be using that in production and use your own SMTP service.

[PhilipWee]

@GaryAustin1 is there a reason why this was suddenly activated? Our user signups has suddenly dropped because suddenly only 4 users could sign up every day 😢

[GaryAustin1]

I have not seen any comment on why this was changed, I have no inside info. It was always warned in the production readiness guide you should use your own SMTP service.

[GaryAustin1]

Here is a detailed explanation:
https://github.com/orgs/supabase/discussions/15896

[PhilipWee]

Thanks for the explanation, its kind of what I expected - supabase needing to protect its email reputation.

Perhaps in the future an email can be sent for such changes, and warnings for people who are not moving out of the supabase SMTP service/other non-production ready tools...

Maybe a "Steps to make supabase production ready" kind of setup process on the supabase dashboard?

[GaryAustin1]

They did send out this, I'm not sure how many users know about the notice field in the upper right of the dashboard. Pretty discrete when there is new message versus another provider I use that has a 10% vertical header in admin section until you dismiss it.

[Drew-Macgibbon]

Ran into this issue while testing auth flow, specifically testing the email verifications. Very annoying that this is set so low, even on a pro plan! 😫

[damiensedgwick]

I have also now ran into this issue. I also never realised the email service wasn't for production use and for testing only which is slightly disappointing.

[glody007]

Ran into this issue while testing auth flow, specifically testing the email verifications. Very annoying that this is set so low, even on a pro plan! 😫

You can use a custom SMTP provider to increase the signup rate limit article

[damiensedgwick]

Ran into this issue while testing auth flow, specifically testing the email verifications. Very annoying that this is set so low, even on a pro plan! 😫

You can increase the signup rate limit article

This isn't technically correct and more like click bait. The docs suggest using Resend as a method of managing emails. You should probably clarify that your link is in fact a self-published article and not an official channel, for which there are plenty.

[glody007]

Ran into this issue while testing auth flow, specifically testing the email verifications. Very annoying that this is set so low, even on a pro plan! 😫

You can increase the signup rate limit article

This isn't technically correct and more like click bait. The docs suggest using Resend as a method of managing emails. You should probably clarify that your link is in fact a self-published article and not an official channel, for which there are plenty.

Thanks for the comment, I just changed it.

[conwayanderson]

hit this while just testing the sign in with email option. If I'm genuinely hitting this due to a rate limit of 4/hr, that's crazy low even for non-production.

[conwayanderson]

it says that this should be 30/hr - I came nowhere close to this and am hitting the limit.

[GaryAustin1]

3 or 4 an hour is the built in limit. Not sure why your setting says 30. Mine says 3 for built in SMTP. If you are debugging auth IMO you need your own provider. There are many with decent free plans.

[conwayanderson]

Needing your own provider to debug kinda defeats the purpose. It'd be great to get clarity on whether the spam issue mentioned in discord is solvable.

…

On Thu, May 16, 2024 at 3:18 AM GaryAustin1 ***@***.***> wrote: 3 or 4 an hour is the built in limit. Not sure why your setting says 30. Mine says 3 for built in SMTP. If you are debugging auth IMO you need your own provider. There are many with decent free plans. — Reply to this email directly, view it on GitHub <#15804 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOLSR53AV6X7NO66GZIFE3ZCSBVXAVCNFSM6AAAAAA2LYVN7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMJUHAYDKMRQG4> . You are receiving this because you commented.Message ID: ***@***.***>

[damiensedgwick]

Needing your own provider to debug kinda defeats the purpose. It'd be great to get clarity on whether the spam issue mentioned in discord is solvable.
…
On Thu, May 16, 2024 at 3:18 AM GaryAustin1 @.> wrote: 3 or 4 an hour is the built in limit. Not sure why your setting says 30. Mine says 3 for built in SMTP. If you are debugging auth IMO you need your own provider. There are many with decent free plans. — Reply to this email directly, view it on GitHub <#15804 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOLSR53AV6X7NO66GZIFE3ZCSBVXAVCNFSM6AAAAAA2LYVN7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMJUHAYDKMRQG4 . You are receiving this because you commented.Message ID: @.>

It is annoying yes! I ended up setting up Resend which is very easy and quick to do if you would like to keep moving forward with your development.