Fake sign-ups on your Supabase app? How to turn on CAPTCHA
Ship ItChecked against the official source
Source checked 3 Oct 2026 · Published 3 Oct 2026 · Last reviewed 3 Oct 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Supabase already limits sign-ups by IP address: by default, 30 requests per 5 minutes. That slows one address down, but it doesn't check whether a person is signing up. For that, Supabase Auth supports two CAPTCHA tools, hCaptcha and Cloudflare Turnstile. Add one to your sign-up form, send its token with every sign-up, then switch CAPTCHA protection on in Supabase.
What to do
- Ask your AI tool to add Cloudflare Turnstile or hCaptcha to your sign-up form and pass its token to Supabase as captchaToken.
- Then turn on CAPTCHA protection in your project's Auth settings, under Bot and Abuse Protection.
- Sign up yourself to check that real people still get in.
Good to know
- Do it in that order: the form first, then the switch, then a real sign-up test.
Source
Checked on 3 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.