Should I turn on email confirmation in Supabase?
For most apps, yes. Without it, anyone can sign up with any email address, including one they don't own, and gets a signed-in session straight away that your database rules treat as a real user.
Why
With email confirmation off, a sign-up returns a working session immediately. Someone can register addresses that belong to other people, create many accounts to get around per-user limits, and use the signed-in role against any policy that trusts every authenticated user.
Turning it on means each new account must click a link sent to its address before it can sign in. Some apps skip it on purpose for a smoother first run; if you do, make sure no policy treats 'signed in' as 'trusted'.
How to check
- In the Supabase dashboard: Authentication, Sign In / Providers, Email, and turn on Confirm email.
- If you manage config in code, set enable_confirmations = true under [auth.email] in supabase/config.toml.
- Shippable reports this from your live app or from config.toml.
More on this: Sign-ups without email confirmation, from the Vibe-Code Top 10.
Check your app
Your first app is free, and it is read-only. You prove the app is yours with a one-line tag first.
More questions
- Is the Supabase anon key safe to expose?
- How do I check if my Supabase tables are readable by anyone?
- Is my Lovable app secure?
- Does verify_jwt protect my Supabase edge functions?
Updated 2026-10-06.