Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Supabase login fails? invalid_credentials vs email_not_confirmed, explained

Ship ItChecked against the official source

Source checked 8 Nov 2026 · Published 9 Nov 2026 · Last reviewed 9 Nov 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Supabase's Auth error codes: invalid_credentials means login credentials or grant type not recognized. email_not_confirmed means signing in is not allowed for this user as the email address is not confirmed. With Confirm Email enabled, users need to confirm their email address before signing in for the first time.

What to do

  1. In your code, read error.code. Errors from the Supabase Auth API always have a code property that identifies the error.
  2. On invalid_credentials, show a wrong email or password message.
  3. On email_not_confirmed, tell the user to check their inbox for the confirmation email.

Good to know

  • Having Confirm Email disabled assumes the user's email does not need to be verified in order to sign in, and implicitly confirms the user's email in the database.
  • Showing a clear message for each code is our tip.

Source

Checked on 8 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.

Related