Before you start
Tick off what you already have. New to tinyRelay? See how onboarding works.
[SMTP host], [port] and [encryption]. Whether SMTP sends receive the same webhooks and metadata as API sends is being confirmed.Configure Supabase custom SMTP
Supabase Auth works with any service that speaks SMTP. You give it the server settings and a default From address; it sends confirmation, magic link, invite and reset emails through them.
- TEAM ONLYDelivers only to members of your project's team
- NOT PRODSupabase says it is not meant for production use
- ALL USERSAuth emails go to every address
- 30 / HOURStarting rate limit; raise it under Rate Limits
- YOUR DOMAINFrom address on your DKIM-signed sender domain
Behaviour as described in Supabase's custom SMTP docs (see Sources).
1. Collect your tinyRelay SMTP details
Map each value Supabase asks for to what tinyRelay issued:
| What Supabase asks for | Management API key | tinyRelay value |
|---|---|---|
| Sender email (default From) | Management API keysmtp_admin_email | tinyRelay valueAn address on your tinyRelay sender domain, such as no-reply@acme.com |
| Sender name | Management API keysmtp_sender_name | tinyRelay valueYour app name |
| Host | Management API keysmtp_host | tinyRelay value[SMTP host] |
| Port | Management API keysmtp_port | tinyRelay value[port] |
| Username | Management API keysmtp_user | tinyRelay value[SMTP username] |
| Password | Management API keysmtp_pass | tinyRelay value[SMTP password] |
2. Enable custom SMTP
Dashboard: open your project's Authentication SMTP settings, enable custom SMTP and enter the values from the table. Management API: send the same values as smtp_* keys.
export SUPABASE_ACCESS_TOKEN="your-access-token"
export PROJECT_REF="your-project-ref"
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
-H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"smtp_admin_email": "no-reply@acme.com",
"smtp_sender_name": "Acme",
"smtp_host": "[SMTP host]",
"smtp_port": "[port]",
"smtp_user": "[SMTP username]",
"smtp_pass": "[SMTP password]"
}'Supabase's own example also sets other Auth options in the same call; the request above changes only the SMTP keys.
3. Raise the rate limit
Once custom SMTP is saved, Supabase applies a starting limit of 30 messages per hour to protect a new sending setup. Raise it to fit your sign-up volume on the Rate Limits page.
4. Send a test Auth email
import { createClient } from "@supabase/supabase-js";
const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
// Triggers a Supabase Auth email, now sent through tinyRelay
const { error } = await supabase.auth.resetPasswordForEmail("you@example.com");
if (error) console.error(error.message);Check the email arrived
The reset email should come from the sender email and name you set, on your tinyRelay sender domain. If it does not arrive, work through the troubleshooting table, then check the DKIM record with the SPF, DKIM and DMARC checker.
Protect your sending reputation
Supabase recommends CAPTCHA protection on sign-up and sign-in forms, so bots cannot use your Auth endpoints to send unwanted email. Sign-up confirmations and resets are verification emails: keep them fast and plain.
Delivery events and the REST API
tinyRelay posts signed webhook events (SEND, DELIVERED, BOUNCED, OPEN, CLICK, UNSUBSCRIBE and SPAM) with your metadata on each one.
Whether SMTP sends receive the same webhooks and metadata is being confirmed, and this guide will be updated when it is.
If you need your own IDs echoed on every event today, send those messages through the API instead: see the transactional email API and email webhooks.
Troubleshooting
The username or password does not match what was issued at onboarding. Copy them again and check for stray quotes or spaces in your environment file.
Check [SMTP host] and [port]. Some hosting providers block outbound SMTP ports; ask yours if a correct host and port still time out.
The encryption mode does not match the port. STARTTLS and implicit TLS are different settings; use the [encryption] you were given.
Send from an address on a domain that was set up with tinyRelay during onboarding.
Check the DKIM CNAME on your sender domain, then the recipient address. The email bounce codes reference explains each bounce category.
FAQ
Supabase's built-in SMTP server only sends to addresses in your project's team and is not meant for production. A custom SMTP server like tinyRelay lets Auth emails reach every user.
The SMTP host and port issued at onboarding with your tinyRelay credentials. They are not published, so this guide shows them as placeholders.
After you enable custom SMTP, Supabase starts with a rate limit of 30 messages per hour. Raise it on the Auth Rate Limits page.
This is being confirmed. Email sent through the REST API gets signed webhook events with your metadata; this guide will be updated for SMTP.
Next steps
- SMTP relay service
- Verification code emails
- Password reset emails
- SPF, DKIM and DMARC checker
- tinyRelay docs: setup