Supabase magic link says "Token has expired or is invalid"? An email scanner opened it
Ship ItChecked against the official source
Source checked 10 Oct 2026 · Published 21 Oct 2026 · Last reviewed 21 Oct 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Supabase's docs say certain email providers may have spam detection or other security features that prefetch links in incoming emails. Their example is Safe Links in Microsoft Defender for Office 365. The link is consumed instantly, so when your user clicks the login or confirmation link they get a "Token has expired or is invalid" error. Supabase's fixes: send a one-time code instead, or link to your own page with a confirm button.
What to do
- Send a one-time code (email OTP) that users type in, instead of a link. In the Supabase email template, that means using {{ .Token }}.
- Or link to your own page with a button that confirms the action.
- Turn off email tracking, so your email links aren't overwritten.
- Ask your AI tool: "Users say the Supabase login link is expired when they click it. Change the email template to send a one-time code they type in, and add a page that verifies it."
Good to know
- By default, a user can only request a magic link once every 60 seconds, and links expire after 1 hour.
Source
Checked on 10 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.