Supabase invalid login credentials: distinguish wrong password from unconfirmed email

"Invalid login credentials": three causes, one message

Supabase deliberately returns the same error for wrong password, unconfirmed email, and unknown user, so attackers cannot enumerate accounts. Your debugging must disambiguate without leaking that distinction to the end user.

Symptom to cause to confirmation to fix

1. Check whether email confirmation is required. If it is, the most common cause is the user never confirmed. Resend the confirmation email and check spam, the sender reputation, and your SMTP config.
2. Check the user exists and is confirmed in the dashboard Auth users list. Do this as the developer, never expose the distinction in the UI. If the user is confirmed and the password fails, it is genuinely a wrong password or a stale credential.
3. For password resets, confirm the recovery email arrived and the link was used within its validity window. Expired recovery links produce the same class of confusion.
4. If signups work but logins fail for everyone, check the Auth configuration: a misconfigured SMTP or a disabled email provider breaks the whole confirmation chain at once.
5. Rate limits can masquerade as credential failures during testing. If a script hammered login, wait out the limit before concluding passwords are wrong.

Verification

Create a fresh test user, confirm the email, and log in. That golden path working while a specific user fails isolates the problem to that user's confirmation or credential state, not your Auth config.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/auth/auth-smtp