Supabase invalid login credentials: distinguish wrong password from unconfirmed email

TL;DR

For "Invalid login credentials": check whether email confirmation is required. If it is, the most common cause is the user never confirmed.

Invalid login credentials

Steps

1. Check whether email confirmation is required. If it is, the most common cause is the user never confirmed. Resend the confirmation email and check spam, the sender reputation, and your SMTP config.
2. Check the user exists and is confirmed in the dashboard Auth users list. Do this as the developer, never expose the distinction in the UI. If the user is confirmed and the password fails, it is genuinely a wrong password or a stale credential.
3. For password resets, confirm the recovery email arrived and the link was used within its validity window. Expired recovery links produce the same class of confusion.
4. If signups work but logins fail for everyone, check the Auth configuration: a misconfigured SMTP or a disabled email provider breaks the whole confirmation chain at once.
5. Rate limits can masquerade as credential failures during testing. If a script hammered login, wait out the limit before concluding passwords are wrong.

When to use

You are seeing this: Resend the confirmation email and check spam, the sender reputation, and your SMTP config. Use this skill when you run into "Supabase invalid login credentials: distinguish wrong password from unconfirmed email".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

If it is, the most common cause is the user never confirmed.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/auth/auth-smtp