How to Configure Sendrealm SMTP for Supabase Auth

Supabase Auth sends confirmation links, password resets, magic links, one-time passwords, and user invitations. Its default SMTP service is intended for evaluation rather than production: Supabase restricts who it can email, applies a low rate limit, and does not provide a delivery SLA. A production application should configure a custom SMTP provider.

This guide connects Supabase Auth to Sendrealm using an authenticated sending domain and a project API key.

What you need before starting

Prepare these four items:

• a Sendrealm project
• a sending domain added and verified in Sendrealm
• a project API key with permission to send email
• a Supabase project where you can edit Auth settings

Use a sender address on the verified domain, such as [email protected]. Do not use a personal Gmail address or another domain that Sendrealm has not authorized.

Supabase recommends separating authentication and marketing traffic. A subdomain such as auth.example.com gives critical account email a distinct identity and reputation from newsletters or promotions sent through marketing.example.com.

Step 1: verify the sending domain in Sendrealm

Open Domains in the Sendrealm dashboard and add the domain or subdomain you intend to use. Copy every DNS record exactly into your DNS provider, then wait for Sendrealm to show the domain as verified.

Do this before entering SMTP credentials in Supabase. Valid credentials cannot compensate for an unauthorized From domain, and testing too early makes authentication failures harder to diagnose.

For a detailed checklist, see How to Verify a Sending Domain in Sendrealm.

Step 2: create a dedicated Sendrealm API key

In the correct Sendrealm project:

1. Open API Keys.
2. Create a project API key.
3. Give it a recognizable name such as supabase-auth-production.
4. Select a sending permission rather than broad resource access when possible.
5. Copy the key and store it immediately in a secret manager.

The API key becomes the SMTP password. Do not put it in frontend code, a browser environment variable, a public repository, or Supabase client configuration.

Use a different key for development and production. That separation makes it possible to rotate one integration without interrupting the other and makes message activity easier to attribute.

Step 3: enter the SMTP settings in Supabase

Open your Supabase project and navigate to Authentication, then the SMTP configuration under Auth settings. Enable custom SMTP and enter:

Port 587 uses STARTTLS and is the usual choice for Supabase. Save the configuration after checking for accidental spaces in the host, username, and password.

The exact navigation labels in Supabase can change. Their current custom SMTP documentation is the source of truth for the Supabase side of the setup.

Step 4: review Auth URLs and email templates

SMTP only controls transport. Before sending a real test, also review:

• the Supabase Site URL
• allowed redirect URLs
• confirmation, recovery, invitation, and magic-link templates
• the visible sender name and address
• Auth rate limits for the expected traffic

A message can be delivered correctly and still create a broken user experience if its redirect URL points to localhost or an unapproved environment.

Keep authentication email focused on the requested account action. Avoid adding promotions to password resets or verification messages. That separation is clearer for users and protects the reputation of critical product traffic.

Step 5: send an end-to-end test

Trigger a real Supabase Auth action rather than sending an unrelated SMTP test. Good checks include:

• creating a test account that requires confirmation
• requesting a password-reset link
• requesting a magic link or OTP
• inviting a controlled test user

Then verify both sides:

1. Supabase accepted and processed the Auth request.
2. Sendrealm shows the email and its recipient event timeline.
3. The receiving mailbox accepted the message.
4. The link opens the correct application URL.
5. The token completes the intended Auth action.

Test at least one mailbox on a major provider and one mailbox on your own corporate domain if both matter to the product.

Troubleshooting common failures

Supabase says the SMTP login failed

Confirm that the username is exactly smtp, the password is the Sendrealm API key, and the key belongs to the intended project. If the key was deleted or rotated, update Supabase with the replacement.

Sendrealm rejects the sender

The sender address must use a domain verified in the same Sendrealm project that owns the API key. Check the From address configured in Supabase and the domain status in Sendrealm.

Supabase accepts the request, but no message arrives

Open the email in Sendrealm and inspect its events. A send event means Sendrealm attempted delivery; a delivery event means the recipient server accepted it, not necessarily that it placed the message in the primary inbox. A bounce, delay, complaint, or suppression event points to a different next action.

The email arrives, but the Auth link fails

Review the Supabase Site URL, redirect allowlist, template variables, and expiration behavior. Some security scanners open links before the recipient does; Supabase warns that single-use links can be consumed by link scanners. Test with the actual mail security path used by your organization.

Messages are rate-limited

Custom SMTP does not remove Supabase Auth rate limits. Review the rate-limit settings in Supabase and increase them only to a level your product and abuse controls can support.

Production checklist

Before relying on the integration for account access:

• verify SPF and DKIM for the sending domain and publish DMARC
• use a dedicated production API key
• keep the key only in Supabase and your secret inventory
• set correct production redirect URLs
• test confirmation, recovery, invitation, and passwordless flows
• monitor bounces, delays, complaints, and suppressions
• document key rotation and provider failover procedures
• keep authentication traffic separate from marketing campaigns

The result

Supabase remains responsible for creating Auth messages and secure links. Sendrealm becomes the SMTP delivery layer and provides the message-level evidence your team needs when a user reports a missing confirmation or reset email.

Open Sendrealm to verify a domain and create the project API key for your Supabase integration.