Supabase’s built-in email service sends two messages an hour, to your own team’s addresses only, and is meant for testing. For real users you give Supabase Auth a provider: enter the Notix SMTP relay under Custom SMTP, or point the Send Email Hook at an Edge Function that calls the email API. App emails such as receipts go out from any Edge Function or database webhook with the same key. Either way, every message carries your DKIM signature, your suppression list and your webhooks. The free plan covers it, no card needed.
Both replace Supabase’s built-in sending. Pick by how much of the email you want to control.
Supabase Auth builds the confirmation, magic link, recovery, invite and email-change messages from its templates and hands each one to the relay over port 465 or 587. Five fields in the dashboard, no code, and the existing templates and {{ .ConfirmationURL }} variables keep working.
Supabase posts the user and the email data (the six-digit token, the token hash, the action type, the redirect) to an Edge Function. The function writes the email it wants and POSTs it to the Notix API. Use it when you need your own HTML, a code rather than a link, or per-language templates.
Receipts, order updates and team notifications are not auth emails. Send them from an Edge Function your app calls, or one a Database Webhook calls when a row changes. Same key, same endpoint, plus an idempotency key so retries are safe.
The sender address must be on a domain you have verified in Notix, or the relay refuses the message. The username is literally notix; the password is an API key.
Enable Custom SMTP: on
Sender email: no-reply@acme.com # an address on a domain verified in Notix
Sender name: Acme
Host: smtp.usenotix.dev
Port number: 465 # implicit TLS; 587 for STARTTLS
Username: notix
Password: <your Notix API key> # Notix → Developer settings → API keys
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
-H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"external_email_enabled": true,
"smtp_admin_email": "no-reply@acme.com",
"smtp_sender_name": "Acme",
"smtp_host": "smtp.usenotix.dev",
"smtp_port": 465,
"smtp_user": "notix",
"smtp_pass": "'"$NOTIX_API_KEY"'"
}'
SMTP_ADMIN_EMAIL=no-reply@acme.com
SMTP_SENDER_NAME=Acme
SMTP_HOST=smtp.usenotix.dev
SMTP_PORT=465
SMTP_USER=notix
SMTP_PASS=${NOTIX_API_KEY}
# then restart the stack so the auth service picks the values up
After saving, send yourself a password reset from your app and open it in the Notix dashboard: it appears in the log like any API send, with the same delivery events. Supabase’s own guide to custom SMTP is at supabase.com/docs/guides/auth/auth-smtp.
Create the hook under Authentication → Hooks, choose HTTPS and this function’s URL, and copy the secret it shows into the function’s secrets. Supabase expects a 200 with an empty JSON body; anything else fails the sign-up.
// supabase/functions/send-auth-email/index.ts
import { Webhook } from "https://esm.sh/standardwebhooks@1.0.0";
const hookSecret = (Deno.env.get("SEND_EMAIL_HOOK_SECRET") as string)
.replace("v1,whsec_", "");
const notixKey = Deno.env.get("NOTIX_API_KEY") as string;
const SUBJECTS: Record<string, string> = {
signup: "Confirm your Acme account",
magiclink: "Your Acme sign-in link",
recovery: "Reset your Acme password",
invite: "You have been invited to Acme",
email_change: "Confirm your new email address",
};
Deno.serve(async (req) => {
if (req.method !== "POST") return new Response("not allowed", { status: 400 });
const payload = await req.text();
const headers = Object.fromEntries(req.headers);
try {
// Supabase signs the hook with Standard Webhooks; a bad signature throws.
const { user, email_data } = new Webhook(hookSecret).verify(payload, headers) as {
user: { email: string };
email_data: {
token: string;
token_hash: string;
redirect_to: string;
email_action_type: string;
site_url: string;
};
};
const type = email_data.email_action_type;
const link =
`${email_data.site_url}/auth/confirm?token_hash=${email_data.token_hash}` +
`&type=${type}&next=${encodeURIComponent(email_data.redirect_to)}`;
const res = await fetch("https://app.usenotix.dev/api/v1/emails", {
method: "POST",
headers: {
Authorization: `Bearer ${notixKey}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
from: "Acme <no-reply@acme.com>",
to: user.email,
subject: SUBJECTS[type] ?? "Your Acme account",
html: `<p><a href="${link}">Continue to Acme</a></p>
<p>Or enter this code: <strong>${email_data.token}</strong></p>`,
}),
});
if (!res.ok) {
const body = await res.text();
throw new Error(`notix ${res.status}: ${body}`);
}
} catch (error) {
// Anything but 200 makes Supabase report the sign-up as failed.
return Response.json(
{ error: { http_code: 500, message: (error as Error).message } },
{ status: 500 },
);
}
return Response.json({});
});
# Never put the key in code or in a NEXT_PUBLIC_ / VITE_ variable.
supabase secrets set NOTIX_API_KEY=<your Notix API key>
supabase secrets set SEND_EMAIL_HOOK_SECRET="v1,whsec_<from Authentication → Hooks>"
supabase functions deploy send-auth-email --no-verify-jwt
The confirmation link above uses the token-hash pattern from Supabase’s server-side auth guide, where a route at /auth/confirm calls verifyOtp. Adjust the path to whatever your app already handles. The hook payload and signature are documented at supabase.com/docs/guides/auth/auth-hooks/send-email-hook.
One fetch to the email API with the key from Deno.env. Called from your app directly, or by a Database Webhook when the row that matters changes.
// Called from your app after an order is paid.
const notixKey = Deno.env.get("NOTIX_API_KEY") as string;
Deno.serve(async (req) => {
const { orderId, email, total } = await req.json();
const res = await fetch("https://app.usenotix.dev/api/v1/emails", {
method: "POST",
headers: {
Authorization: `Bearer ${notixKey}`,
"Content-Type": "application/json",
// A retried invocation with the same key returns the first send
// instead of emailing the customer twice.
"Idempotency-Key": `order-${orderId}-receipt`,
},
body: JSON.stringify({
from: "receipts@acme.com",
to: email,
subject: `Your Acme receipt for order ${orderId}`,
html: `<p>Thanks for your order. Total: ${total}.</p>`,
}),
});
if (!res.ok) {
return Response.json({ error: await res.text() }, { status: 502 });
}
const { emailId } = await res.json();
return Response.json({ emailId });
});
// Triggered by a Database Webhook on UPDATE of public.orders.
// Supabase posts { type, table, record, old_record, schema }.
const notixKey = Deno.env.get("NOTIX_API_KEY") as string;
const webhookSecret = Deno.env.get("ORDERS_WEBHOOK_SECRET") as string;
interface Order { id: string; email: string; status: string; total: string }
interface Payload { type: "INSERT" | "UPDATE" | "DELETE"; record: Order; old_record: Order | null }
Deno.serve(async (req) => {
// Add a secret header to the webhook in the dashboard and check it here.
if (req.headers.get("x-webhook-secret") !== webhookSecret) {
return new Response("forbidden", { status: 403 });
}
const { record, old_record } = (await req.json()) as Payload;
if (record.status !== "paid" || old_record?.status === "paid") {
return Response.json({ skipped: true });
}
const res = await fetch("https://app.usenotix.dev/api/v1/emails", {
method: "POST",
headers: {
Authorization: `Bearer ${notixKey}`,
"Content-Type": "application/json",
"Idempotency-Key": `order-${record.id}-receipt`,
},
body: JSON.stringify({
from: "receipts@acme.com",
to: record.email,
subject: `Your Acme receipt for order ${record.id}`,
html: `<p>Thanks for your order. Total: ${record.total}.</p>`,
}),
});
return Response.json({ ok: res.ok }, { status: res.ok ? 200 : 502 });
});
The response carries an emailId. Register a webhook in Notix and the delivered, bounced and complained events for that id post back to you; the docs show the event shapes and how to verify the signature.
Supabase's default email service sends two messages an hour, only to addresses of people on your project team, with no delivery guarantee. Anyone else signing up gets an error, not a slow email. Custom SMTP or the hook is the production path, not an optimisation.
A confirmation email from an address you do not own has no SPF or DKIM that names you, so a mailbox provider has nothing to trust. Set the sender to an address on a domain you have verified in Notix; the relay then signs every message with your DKIM key and passes DMARC alignment.
Once custom SMTP is on, Supabase applies its own limit of 30 auth emails an hour by default. It protects your sender reputation on day one, but a launch or a bulk invite will hit it. Raise it under Authentication → Rate Limits before you need to, not after users start complaining.
The stock subject lines and bodies are generic, and generic is a spam signal. Edit them under Authentication → Emails so the subject names your product, the body says why the email exists, and the link text says where it goes. With the hook, the email is entirely yours to write.
Not sure which one you have? Check your domain’s SPF, DKIM and DMARC first; it is the fix in most cases.
A route handler, a server action and a contact form on the App Router, with a React Email template.
ProductPoint any framework's mailer at one host and port; the relay turns SMTP into the same tracked, suppressed send.
LearnWhat a pre-send deliverability check looks at, the verdict and score it returns, and the four findings that block a send.
Use casesPasswordless sign-in by email: the token, the link, the send, and what to do when the link is opened twice.
NotixThe quickstart: verify a domain, copy an API key, send the first email.
NotixA free plan with no card, and Pro at $15 a month for 50,000 emails. Only sent volume is metered.
Verify your domain, copy an API key, paste five SMTP fields. The free plan's 5,000 emails a month cover the sign-ups; no card.