Allow signin without Email Verification

[dipeshhkc]

Hello Team. I have been using supabase for a week now and it is wonderful. Thank you for your hard work 🙇

I have a question. Please provide me with your suggestions on this.

I need to allow users to sign in even without email verification. I found Enable email confirmation setting and disable that option. But still I get Email Not Confirmed message during signin.

Is this intended? Or am I missing something?

[dipeshhkc]

It seems this doesn't work for the user-created from the server.
Is there any way to automatically verify the email or allow login without email verified for the user-created by the admin API?

[sadiki-o]

if u sign up a new user using the supabase.auth.signup() function u can pass confirmation_sent_at with a date so the new created user can signin, otherwise try to create a trigger whenever a new user is added to supabase the trigger after that update the new user row and set confirmation_sent_at to the current date which is now()

[WarrenBuffering]

Would we pass confirmation_sent_at along with the superbase.auth.signUp request? As part of the body's data property? Eg.

  const response = await supabase.auth.signUp({
    email,
    password,
    data: {
        confirmation_sent_at: Date.now(),
    },
  });

[WarrenBuffering]

A follow-up with more detail, though this is a patchy workaround and I'd rather not have to be using it.

Following this video, the function I created auto_confirm_account

begin
  NEW.email_confirmed_at = NOW();
  NEW.confirmed_at = NOW();
  RETURN NEW;
end;

Which I then set up a trigger auto_confirm_user which calls auto_confirm_account on INSERT for auth.users

[kiwicopple]

checking with the auth team now - I would have thought that the Enable email confirmation disabled would work for server-side updates. Will update again soon!

[kangmingtay]

hey @dipeshhkc, can you please email us at support with your project ref? Disabling "Enable email confirmations" shouldn't require you to still verify your email on sign-in so it might be a bug specific to your project.

[kangmingtay]

if u sign up a new user using the supabase.auth.signup() function u can pass confirmation_sent_at with a date so the new created user can signin, otherwise try to create a trigger whenever a new user is added to supabase the trigger after that update the new user row and set confirmation_sent_at to the current date which is now()

@sadiki-o can you elaborate more on how you were able to do this? AFAIK, the supabase.auth.signup() method doesn't support passing the confirmation_sent_at time

[rommyarb]

I've also experienced this when creating a user from the server using supabase.auth.api.createUser().
You can solve it by passing email_confirm attribute.

const createNewUser = await supabase.auth.api.createUser({
  email: 'me@mydomain.com',
  password: '123456',
  email_confirm: true,
})

[mike-luabase]

Is this fixed? I can't call supabase.auth.signUp without being forced to confirm the email.

[J0]

Hey @mike-luabase ,

Thanks for the query! You should be able to call supabase.auth.signUp without email confirmations enabled.

[J0]

Closing for ow but let us know if there are still issues

[lerayj]

Same issue since the dashboard update. There is also a visual bug, the switch "Confirm mail" in section Auth provider is not set to the updated value after a save, but after a page reload everything seems fine.

But since on both case the email validation check is activated, it's kinda pointless :/

[aungmyatmoethegreat]

Same issue triggered RN. I'll link to my repo soon.

[RobertB4]

The solution posted above of adding email_confirmed: true does not work with supabase-js v2. Is there any way to handle this with v2 or does this feature no longer exist?

[tekagg]

@J0 is there any way currently to allow users to sign in without email verification completed? If not maybe this one should be reopenend.

Update:
I confirm that there is a visual bug in the UI for the Authentication Settings / Auth Providers / Email / Confirm email switch. The switch visually updates its state only after page refresh but not on save.

Also for anyone that is looking to turn off the email confirmation for signUp the Confirm email switch is working only for newly created users but not for the ones created before the switch was turned off. By turning off Confirm email, no email confirmation link will be sent at signUp. If you still want to verify the user email after signUp, you'll probably need to use verifyOtp() method.

I create a new bug for the visual issue: #9897

[J0]

Hey @RobertB4,

Thanks for your query! The email_confirmed: true setting should still work. Do note, however, that the method has now been moved to the admin namespace so it would now be:

supabase.auth.admin.createUser({
...
})

Here are the docs for reference

Let me know if you still face issues!

[J0]

Hey @agalbenus,

There is no change to existing behaviour - users should still be able to sign in without email verification completed if the Confirm Email toggle is set to false.

Let me know if there are still issues

[JamesDHW]

The docs here say you can control this as a setting in your dashboard, however the link to the location of the switch seems to be outdated.

I found the switch to control whether email verification is required is here, which changes the setting for all users.

[kangmingtay]

thanks @JamesDHW, we'll make sure to update the corresponding link in the docs!

[groyGetaway]

Hi, we currently have some users that are "email verification pending" but that can't signin even if we toggle the email verification off. When signing in, there is a email verification pending error.

I see this behavior is tied to the "confirmed_at" field of auth.users. Unfortunately this field cannot be modified. When I try i get an error saying it can only be set to DEFAULT.
If I could update this field I could fix this issue myself. I guess it is blocked due to security? But I'm the admin, I feel like it would make sense for me to be able to edit it.

Edit:
Actually, this was tied to "email_confirmed_at" of table auth.users. This one was modifiable, so I fixed my issue with a script.
All good! Hopefully this can help someone else.

[RizanPSTU]

Found the place to disable the email verification.

[aungmyatmoethegreat]

Found the place to disable the email verification.

Is that working?

[aungmyatmoethegreat]

It wasn't working well when I was testing

[kindr3-dev]

@amm834 It works with me

[filippo-brigati]

Would we pass confirmation_sent_at along with the superbase.auth.signUp request? As part of the body's data property? Eg.

  const response = await supabase.auth.signUp({
    email,
    password,
    data: {
        confirmation_sent_at: Date.now(),
    },
  });

Hi, I'm trying to self host supabase, but when I try to add new user using .signUp(), i get 500 error: Error sending confirmation mail, Is there any way disable confirmation email verification?

[kangmingtay]

@filippo-brigati you'll need to set GOTRUE_MAILER_AUTOCONFIRM="true" for emails to be autoconfirmed (essentially disabling email verification)

[filippo-brigati]

I solved using createUser() and passing email_confirm: true, to use createUser() you must replace your anon_key with your SERVICE_ROLE_KEY. Here there is an example:

const { data, error } = await supabase.auth.admin.createUser({
    email: email,
    password: password,
    user_metadata: {
      some_data: data,
    },
    email_confirm: true,
  });

[maryam-sabzalipour]

It worked for me! thanks a lot @JamesDHW

[MSohailMemon]

There is a weird bug with supabase auth. I have a project in which email verification is required. I have enabled this toggle Confirm Email but still when a user sign up or I create a user using supabase.auth.admin.createUser({ ..., email_confirm: false}) the user gets added. I signin is also working without verifying the email.
On supabase console 'waiting for confirmation' is also not coming. It is showing like below:

[kangmingtay]

I have enabled this toggle Confirm Email but still when a user sign up or I create a user using supabase.auth.admin.createUser({ ..., email_confirm: false}) the user gets added.

@MSohailMemon i don't think i understand the bug fully here.... the "Confirm Email" setting doesn't prevent a user from signing up or being created by the admin method

I signin is also working without verifying the email.

can you please provide the steps to reproduce this?

On supabase console 'waiting for confirmation' is also not coming.

That means that the user you created was confirmed already

[MSohailMemon]

@kangmingtay Thanks for replying on this issue. However, I realised the issue was at my end. One of my webhook was updating the user on supabase in which confirm_email was set to true.
Thanks