# Supabase auth email rate limits: plan capacity before you need it
Auth emails (OTP, magic links, confirmations) are rate limited per project. Under normal dev use you never notice. During a launch, a load test, or an agent-driven signup script, you hit the cap and signups start failing with rate-limit errors that look like an Auth outage.
## Checkable procedure
1. Read the current rate limits in the dashboard under Authentication, Rate Limits. Know the per-hour caps for each email type before launch.
2. Set up custom SMTP for production. The built-in email service is for development; custom SMTP raises your limits and improves deliverability. Configure it in Authentication, SMTP settings, and verify with a test send.
3. Never run signup load tests against the built-in email service. You will burn the quota and block real users. Throttle test signups or stub the email step.
4. Handle rate-limit errors in your signup UI with a clear "try again in a few minutes" message, not a generic failure. Users retrying aggressively makes the limit worse.
5. Monitor the auth logs during launch for rate-limit rejections. A spike in rejected email sends is the early warning, not user complaints.
## Quick test
Send a burst of test signups at your expected launch rate against staging with custom SMTP configured. If any fail with rate-limit errors, raise the cap or slow the flow before production.