← setup-guides

Password Reset Email Setup

If password reset emails are not arriving, follow these steps to configure Supabase email settings.

1. Configure Redirect URLs in Supabase

  1. Go to your Supabase Dashboard
  2. Navigate to Authentication > URL Configuration
  3. Under Redirect URLs, add:
    • http://localhost:3000/auth/reset-password (for local development)
    • https://yourdomain.com/auth/reset-password (for production)
  4. Click Save

2. Configure Email Provider

Supabase uses its default email service by default, which has rate limits. For production, configure a custom SMTP provider.

Option A: Use Supabase Default (Development Only)

The default email service works for development but has limitations:

  • Rate limited (may not send emails if too many requests)
  • May go to spam
  • Limited customization
  1. Go to Authentication > Settings > SMTP Settings
  2. Enable Custom SMTP
  3. Configure your SMTP provider (Gmail, SendGrid, AWS SES, etc.)

Example SMTP Configuration:

  • Host: smtp.gmail.com (for Gmail)
  • Port: 587
  • Username: Your email address
  • Password: App-specific password (not your regular password)
  • Sender email: The email address that will send the reset emails
  • Sender name: HiveJournal

If you're already using Resend for other emails, configure Supabase to use Resend's SMTP service.

Quick Setup:

  1. Go to Supabase Dashboard → Authentication → Settings → SMTP Settings
  2. Enable Custom SMTP
  3. Configure:
    • Host: smtp.resend.com
    • Port: 587 (recommended) or 465
    • Username: resend
    • Password: Your Resend API key (same as RESEND_API_KEY env var)
    • Sender email: Your verified Resend email (e.g., noreply@hivejournal.com)
    • Sender name: HiveJournal

For detailed step-by-step instructions, see RESEND_SMTP_SUPABASE_SETUP.md

3. Customize Email Template

  1. Go to Authentication > Email Templates
  2. Select Reset Password template
  3. Customize the email content
  4. Make sure the redirect link uses: {{ .ConfirmationURL }}

Example Template:

Subject: Reset Your Password

Click the link below to reset your password:

{{ .ConfirmationURL }}

This link will expire in 1 hour.

If you didn't request this, please ignore this email.

4. Test Password Reset

  1. Go to /auth/forgot-password
  2. Enter your email address
  3. Check your email inbox (and spam folder)
  4. Click the reset link
  5. Set a new password

5. Troubleshooting

Emails Not Arriving

  1. Check Supabase Logs:

    • Go to Logs > Auth Logs in Supabase Dashboard
    • Look for email sending errors

  2. Check Email Provider:

    • Verify SMTP credentials are correct
    • Check if your email provider has rate limits
    • Ensure sender email is verified

  3. Check Spam Folder:

    • Password reset emails often go to spam
    • Add the sender to your contacts

  4. Rate Limiting:

    • Supabase has rate limits on password reset requests
    • Wait a few minutes between attempts
    • Use custom SMTP to avoid rate limits

  5. Redirect URL Issues:

    • Ensure redirect URL is whitelisted in Supabase
    • Check that the URL matches exactly (including protocol and path)

Common Errors

  • "Email rate limit exceeded": Wait a few minutes or configure custom SMTP
  • "Invalid redirect URL": Add the URL to Supabase redirect URLs list
  • "Email not sent": Check SMTP configuration and logs

6. Development vs Production

Development

  • Can use Supabase default email service
  • May need to check spam folder
  • Rate limits may apply

Production

  • Must configure custom SMTP
  • Use a verified domain for sender email
  • Monitor email delivery rates
  • Set up email analytics

7. Security Considerations

  • Password reset links expire after 1 hour (default)
  • Links can only be used once
  • Rate limiting prevents email enumeration attacks
  • Always show success message (don't reveal if email exists)
PASSWORD RESET SETUP — Docs | HiveJournal