2026 Supabase Free Project Email Templates Restricted: How to Test Signup Emails?

The signup request succeeds, but the confirmation email is missing or does not look like the product’s brand.

Test the working signup flow with the project’s current default template first; if branded copy or styling is part of acceptance, confirm the project’s applicable rules before evaluating custom SMTP or a suitable plan.

This guide is for independent developers testing signup in a new Supabase free project, QA engineers separating delivery from verification, and technical leads deciding whether template control is a release requirement.

Last updated October 25, 2026; policy details checked against Supabase’s change notice and current Auth documentation.

Check the project and its email service before testing

Start by recording which environment is under test. A hosted Supabase project, a self-hosted deployment, and a local development environment do not necessarily use the same email configuration or template behavior. A result from one should not be treated as proof about the others.

For a hosted project, check the project’s creation date, plan, and current Auth email settings. Supabase’s notice says that, starting June 3, 2026, newly created free projects using the default email service can’t customize Auth email templates. The notice also distinguishes previously created free projects, paid plans, custom SMTP, and self-hosted projects. Check the official change notice for the applicable scope rather than assuming every project has the same restriction.

Next, identify whether the test is about function or presentation:

• Functional acceptance: Can the application trigger signup, deliver a confirmation message to an allowed recipient, and reach the expected verified-account state?
• Brand acceptance: Can the project use the required product copy, styling, and template variables?

These are separate checks. A default message may be enough to validate the signup flow, but that does not establish that a branded email is approved. Conversely, a template that looks right does not prove that an email was delivered or that the account became verified.

Record the project environment, the email service in use, and the acceptance goal before triggering signup. This small test record helps prevent a local template preview from being mistaken for evidence about hosted delivery.

Decide what the test must prove

A useful test treats email signup as a chain of distinct outcomes:

• The application accepted the signup request.
• The project attempted to send a confirmation message.
• An authorized test inbox received a message that can be read.
• The message contains a usable confirmation link or code for that signup.
• Following the confirmation flow changed the account state as expected.

Do not collapse those outcomes into “email works.” A successful API response does not prove inbox delivery. A message in an inbox does not prove that its link points to the right application. A confirmation page does not, by itself, prove that the application stored the expected verified status.

The required evidence depends on the release goal. For a basic feature test, capture the application response, the received message, and the final account state. For a brand review, also check the actual rendered message in the target inbox and confirm the expected copy, layout, sender identity, and links. If branding is not part of this test, avoid treating the default template’s appearance as a signup defect.

Trigger signup with a traceable test account

Use an isolated project and an account reserved for testing the product being developed. Avoid using a coworker’s primary inbox or customer data as a convenient substitute. Those choices can expose personal information, mix test messages with work correspondence, and create cleanup work when a test sends repeated confirmations.

For each attempt, record:

• The environment and project under test.
• The test account’s recipient address.
• The time and result returned by the application.
• Whether the project is using the default email service or configured SMTP.
• The message and account-state evidence collected afterward.

Check that the recipient is within the sending scope allowed by the project’s current configuration. The default service may restrict where it can send; the existence of a syntactically valid address does not mean that the project is permitted to send to it. If a request is rejected, investigate the recipient rules, Auth settings, and current sending limits before attributing the failure to a template restriction.

This distinction matters in automated tests, too. A test that submits many signup requests can run into documented Auth email limits even when the template is correct. Supabase’s current Auth rate-limit documentation describes the limits that apply; check it alongside the project configuration rather than assuming a test suite can send without restriction.

Check whether a new free project can edit its signup template

For a newly created free project using the default email service, the official change notice says Auth email templates cannot be customized under the stated policy. That restriction concerns template customization; it should not be read as proof that signup itself cannot be tested.

The practical test is to use the template the project currently provides and verify the functional flow. If the acceptance criteria require a product-branded subject line, message copy, or layout, treat that as a separate requirement and confirm which configuration route applies to the project.

Supabase’s Auth email template guide documents template structure and supported variables. For example, {{ .ConfirmationURL }}, {{ .Token }}, {{ .SiteURL }}, and {{ .Email }} are useful variables to recognize when reviewing a template. Their presence does not guarantee that a message will be delivered, that a link will lead to the intended application, or that every client will render the email identically. Verify the actual message and resulting application behavior.

If the project’s creation date, plan, or email service does not clearly match the notice, do not infer eligibility from another project’s settings. Check the latest official announcement and the project’s own dashboard before deciding that a template option is available or unavailable.

Compare the available test paths

The right path depends on what the team needs to learn. The table compares common options without treating them as interchangeable.

Supabase’s custom SMTP guide describes the configuration path for projects using an external SMTP service. Treat that as a way to evaluate sending and template control, not as a delivery guarantee. A valid configuration can still be affected by sender authorization, provider rules, recipient acceptance, or spam filtering.

Local work is useful when the aim is to iterate on a template or test application behavior without relying on hosted delivery. Supabase’s local template customization guide covers that environment. The boundary is important: a local success cannot establish that the hosted project will send to a particular recipient or that a hosted inbox will display the message in the same way.

Inspect the message and its confirmation link

When the test message arrives, check more than its subject line. Confirm that the recipient matches the test account, the message corresponds to the signup attempt, and the confirmation action is present. If the flow uses a code rather than a link, confirm that the code belongs to the attempt being tested and is entered through the application’s intended route.

Supabase’s template documentation explains the available variables and how the confirmation content is constructed. Use that documentation to review the intended link and redirect configuration. Do not assume all mail clients, test inboxes, or deployment environments will behave identically: link wrapping, previews, and rendering can differ. The final check should take place through the product’s actual confirmation flow.

For a test address, confirm that it can receive and display the message before starting the run, and that the tester can access the confirmation link or code. If the project rejects the recipient, choose an address that is within the project’s permitted sending scope. Do not bypass project restrictions by treating an arbitrary address as authorized.

Complete verification and inspect account state

Open the confirmation link or submit the code through the application’s expected flow. Then inspect the account using the application’s own status display or an authorized project-level check. The test passes only when the observed state matches the product’s expected behavior.

A complete test record should distinguish:

• Request outcome: what the application returned after signup.
• Receipt outcome: whether the message appeared in the test inbox.
• Content outcome: whether the message contained the correct recipient and confirmation action.
• Verification outcome: whether completing the action changed the account state and returned the user to the expected application experience.

This separation makes failures easier to diagnose. If the signup request fails, investigate application validation and Auth configuration. If the request succeeds but no message is readable, check recipient eligibility, sending limits, and email configuration. If the message arrives but confirmation fails, inspect the link or code handling and the application’s verification logic. A template change is not a general fix for failures in these other stages.

For automated testing, use an isolated test project and make each test run traceable to its signup attempt. Avoid asserting only that a message exists: verify the recipient and confirmation content, then confirm the resulting account state. Where repeated test runs are needed, account for the project’s current sending limits and the cleanup behavior of the test environment.

Choose a template strategy from the acceptance criteria

Use these conditions to make the configuration decision:

• If the goal is to prove the signup flow and the default template is usable, test with the current template and an eligible test recipient. Keep evidence for receipt and the final account state.
• If the goal includes branded copy or styling, first confirm the project’s eligibility under the current policy. Then evaluate custom SMTP or an applicable plan as separate configuration options.
• If the goal is template development without hosted delivery, use the local workflow, but do not report it as proof of hosted sending.
• If the test inbox cannot receive messages from the project, resolve the project’s recipient or SMTP configuration first. Do not assume that changing the template will grant sending permission.
• If the test concerns an important account that must remain accessible, use an inbox with reliable long-term access rather than a temporary address.

Custom SMTP can provide a route to a different sending configuration, but it introduces setup and operational work. The Supabase SMTP documentation should be checked for current requirements. Configuration is only one part of acceptance: test a real message, its content, and the complete verification path after any change. Never treat successful SMTP setup as a guarantee of inbox placement.

The trade-off is straightforward. The default service is simpler for checking a functional flow, but may not meet branding requirements or permit every recipient. A custom sending setup offers more control where supported, but requires its own configuration and delivery validation. Local templates speed up development work, but cannot stand in for a hosted send test.

Keep the test address separate from the product decision

A test inbox should be chosen for access, privacy, and compatibility with the project’s allowed recipient scope. An address that is convenient but cannot be read by the tester is not useful evidence. An inbox that forwards to a primary address may simplify review, but the forwarding setup still needs to be accessible and appropriate for the data involved.

For disposable testing, OrbSend can be considered as a way to receive a test message without exposing a primary address. Check that the project permits sending to the selected recipient before using it; no test inbox can override Supabase’s sending rules or guarantee delivery. For broader context, see OrbSend’s guidance on email arrival times and mailbox privacy.

If the test is only for a temporary signup, a demo account, or a single confirmation check, a separate test inbox can keep development mail out of a primary mailbox. For banking, payment, government, or other accounts that require long-term recovery, use an inbox the account owner can reliably access instead. When a hosted Supabase project allows the selected test recipient, OrbSend offers an immediate, no-registration way to receive temporary email while keeping the primary address out of the signup form.