Viesti Sign in

Custom SMTP for Supabase Auth emails

Supabase Auth sends signup confirmations, magic links, invites and password resets by email. Its built-in SMTP service only delivers to your team's addresses and is currently limited to 2 messages per hour, so production projects need custom SMTP. These are the values for Viesti.

Before you start

  1. Sign in and verify the domain you send from. Viesti accepts a message only when its From address is on a domain verified in your workspace and the envelope sender (MAIL FROM), which most libraries take from the From address, is on the same domain. DNS setup lists the records.
  2. Create an API key on the Credentials page of the dashboard. It is shown once. The key is the SMTP password; the username is apikey.
Setting Value
Host smtp.viesti.email
Port 587 with STARTTLS, or 465 with TLS from the first byte
Username apikey
Password Your API key: mr_ followed by 64 hex characters
Authentication PLAIN, offered only once the connection is encrypted

Enter the SMTP settings

In the Supabase dashboard, open Authentication, then Emails, then the SMTP Settings tab. Turn on Enable custom SMTP and fill in:

Field Value
Sender email address An address on your verified domain, such as [email protected]
Sender name Your product's name
Host smtp.viesti.email
Port number 587 (or 465)
Minimum interval per user Your choice: the minimum seconds between two emails to the same user
Username apikey
Password Your API key

There is no TLS setting. Supabase Auth sends with the gomail library, which uses TLS from the first byte when the port is exactly 465 and otherwise upgrades with STARTTLS when the server offers it, as Viesti does on 587. Viesti accepts submissions only on those two ports.

Or use the Management API

The same fields can be set with the Supabase Management API and a personal access token:

curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "smtp_admin_email": "[email protected]",
    "smtp_sender_name": "Your App",
    "smtp_host": "smtp.viesti.email",
    "smtp_port": 587,
    "smtp_user": "apikey",
    "smtp_pass": "'"$VIESTI_API_KEY"'"
  }'

Rate limits

Once custom SMTP is saved, Supabase limits Auth to 30 emails per hour. Raise it under Authentication, Rate Limits. Keep the limit within your Viesti plan: every Auth email counts as one email, and the free plan allows 75 per UTC day and 2,000 per UTC month; see Limits and Pricing.

Test it

Invite a user from Authentication, Users, or request a password reset from your app. The message appears on the Activity page in Viesti, from the sender address you entered.

Supabase recommends DKIM, SPF and DMARC for the sending domain. Viesti verifies a domain only once all three records are published; see DNS setup.

Common errors

When a send fails, Supabase Auth answers the request with HTTP 500 and a message such as Error sending confirmation email, Error sending recovery email or Error sending magic link email, and records the SMTP error on that request's entry in the Auth logs. The SMTP error is one of Viesti's replies:

Replies from Viesti

Whatever the library, its error includes the server's reply. These are the ones caused by your setup or account:

Reply Meaning
535 5.7.8 Authentication failed The API key is wrong, revoked or empty. After ten failed attempts from one client address within ten minutes, that address is refused for ten minutes with 454 Too many failed authentications; retry later.
525 5.7.13 Workspace suspended; contact support The key is valid, but the workspace is suspended or under review. Write to [email protected]; a new key does not help.
550 5.0.0 sending not permitted The From domain is not verified in this workspace, the envelope sender is on a different domain than the From header, or the workspace is not active.
550 5.0.0 recipient suppressed The recipient is on your suppression list after a bounce or complaint; see Bounces.
451 4.0.0 submission quota exceeded The free plan's 75 emails per UTC day or 2,000 per UTC month are used up; see Limits. It is temporary: retry after the reset or upgrade.
452 4.5.3 Maximum limit of 50 recipients reached One message can have at most 50 recipients. Split the send.
552 5.0.0 message too large The message, attachments included, is over 10 MB.
554 5.0.0 rejected by content audit Content screening found the message in violation of the Terms of Service. It is not relayed.

A 250 reply means Viesti accepted the message. Content screening runs before relay; mail it flags is held for review and shows as quarantined on the Activity page.

The most common are a wrong Password (535) and a Sender email address on an unverified domain (550 sending not permitted).

Next steps

  • DNS setup: DKIM, SPF, DMARC and return-path records for your domain.
  • SMTP reference: ports, TLS and authentication in detail.
  • HTTP API: send the same message as JSON over HTTPS.
  • Limits and Bounces: quotas, message size and suppressions.

Dashboard fields, the default SMTP limits and the Management API fields are from Supabase's Send emails with custom SMTP guide and the Supabase Studio source; the port behavior is from Supabase Auth's mailer client and gomail's dialer. Checked 26 September 2026.