Supabase auth emails, on your own domain

Supabase ships with an email sender, and its own docs will tell you not to use it in production. It's rate-limited to a testing figure and it sends from a shared domain, so the first real sign-up spike either gets throttled or lands in spam. Every Supabase project that reaches production has to bring its own SMTP provider for auth mail.

That has always worked with eusend — host, port, key, sender, five fields. It's now one click instead, from Settings → Integrations.

What the one click actually does

You authorize eusend against your Supabase organization, pick a project and one of your verified domains, and we do four things:

1. Mint a new API key scoped to that one domain. Not a full-access key, and not one you already had.
2. Write the SMTP block into that project's auth configuration — host, port, username, the key, your sender.
3. Raise Supabase's auth-email rate limit, which is almost always the real bottleneck. More on that below.
4. Record the connection, so disconnecting later knows exactly what to undo.

Then Supabase's confirmations, magic links, password resets and invites go out DKIM-signed on your domain, and every one of them shows up in your eusend dashboard alongside the rest of your mail.

The key can only send from the domain you picked

This is the part worth being explicit about, because you are about to paste one system's credential into another system's config.

The key we create carries sending access for a single domain. If the smtp_pass sitting in your Supabase auth config ever leaks, it reaches that one domain's sending and nothing else — not your other domains, not your contacts, not your account. And because it's a key we made rather than one of yours, disconnecting can revoke exactly it and break nothing you were using elsewhere.

We ask for three scopes, and deliberately no more

The OAuth grant requests exactly this:

auth:write           the SMTP write itself
projects:read        so you can pick a project
organizations:read   so we can show you the org name before you commit

That's the minimum that makes the feature work. It's tempting to ask for a little more while the consent screen is open — widening scopes later forces every existing user to re-authorize, so there's a real pull toward taking a wide grant once.

We think that's the wrong trade. An email provider asking for database or secrets should read, to anyone paying attention, as a request for your entire project. Better to come back and ask again if we ever genuinely need something else.

The rate limit is the part people miss

Supabase caps auth-email throughput separately from your SMTP provider, and its default is 30 an hour. That number is a testing figure, and it's the one that bites: your provider is fine, your domain is verified, mail is flowing — and Supabase is quietly holding sign-up confirmations in a queue.

Connecting through the integration sets it to 500 an hour, and the field is right there in the form if your volume is different. Automating the SMTP setup and then leaving you to discover that cap on your own would have been a strange place to stop.

Your eusend sending limits still apply on top, as they always do.

Disconnecting puts the project back

Disconnect revokes the key we made and clears the SMTP block, returning the project to Supabase's built-in sender.

The other option was to revoke the key and leave the configuration in place. That's tidier for us and worse for you: your auth mail starts failing with 535 and our name on it. Supabase's own rate-limited sender is a working fallback. A credential we just destroyed is not.

A note on paused projects

Supabase pauses free projects after a week of inactivity, and a paused project can't accept an auth-config write. That's the ordinary state of a project someone is setting up, not an edge case, so the picker greys those out and tells you why rather than letting you get most of the way through and then fail.

If one pauses between the picker and the save, we revoke the key we just minted and say so. Nothing is left half-configured on either side.

Setting it up by hand still works

Nothing about the manual path changed, and it's still the right choice if you'd rather not grant write access to your project's auth configuration. Five fields, same as before:

Host:          smtp.eusend.dev
Port:          465
Username:      eusend
Password:      <an eusend API key, eu_live_…>
Sender email:  no-reply@yourdomain.com   (must be a verified domain)

The full walkthrough, including the rate limit and what a 535 is telling you, is in the Supabase SMTP docs.

---

If you connect a project and something about the flow is confusing, or Supabase refuses something we don't explain well, tell us at support@eusend.dev. This one touches another vendor's configuration, so we'd rather hear about the rough edges early.