Supabase Auth template examples
These minimal templates make the security-relevant variables and destinations easy to audit. Replace the product name, support address, and visual presentation, but preserve the selected flow.
Hosted templates are edited under Supabase → Authentication → Email Templates. New Free plan projects must configure custom SMTP before Supabase permits template customization.
Confirm signup with OTP
Use this when SIGN_UP_EMAIL_VERIFICATION is otp and hosted Confirm Email is enabled.
Subject
{{ .Token }} is your Supacharger confirmation code
Body
<!doctype html>
<html lang="en">
<body style="font-family: Arial, sans-serif; color: #171717; line-height: 1.5">
<h1>Confirm your email address</h1>
<p>Enter this code in Supacharger:</p>
<p style="font-size: 32px; font-weight: 700; letter-spacing: 0.18em">
{{ .Token }}
</p>
<p>This code expires according to the account security policy.</p>
<p>If you did not create this account, you can ignore this email.</p>
</body>
</html>
Add a confirmation link only when SIGN_UP_EMAIL_VERIFICATION is explicitly otp-and-link; using either alternative consumes the same one-time verification.
Confirm signup with a link
Use this when SIGN_UP_EMAIL_VERIFICATION is link, hosted Confirm Email is enabled, and the application supplies the canonical origin as its allowed redirect.
Subject
Confirm your Supacharger account
Body
<!doctype html>
<html lang="en">
<body style="font-family: Arial, sans-serif; color: #171717; line-height: 1.5">
<h1>Confirm your email address</h1>
<p>Use the button below to finish creating your Supacharger account.</p>
<p>
<a href="{{ .RedirectTo }}&token_hash={{ .TokenHash }}&type=email"
style="display: inline-block; padding: 12px 18px; background: #171717; color: #ffffff; text-decoration: none; border-radius: 6px">
Confirm email address
</a>
</p>
<p>This link expires according to the account security policy and can be used once.</p>
<p>If you did not create this account, you can ignore this email.</p>
</body>
</html>
Verify that the resulting URL contains exactly one /auth/confirm path. If the installed application passes a route rather than an origin as emailRedirectTo, preserve that contract instead of appending the route twice.
Password recovery
The Supabase-generated confirmation URL contains the recovery token and the allowed redirectTo destination supplied by the application.
Subject
Reset your Supacharger password
Body
<!doctype html>
<html lang="en">
<body style="font-family: Arial, sans-serif; color: #171717; line-height: 1.5">
<h1>Reset your password</h1>
<p>We received a request to reset the password for this email address.</p>
<p><a href="{{ .ConfirmationURL }}">Choose a new password</a></p>
<p>This link can be used once. If you did not request it, you can ignore this email.</p>
</body>
</html>
The request supplies /auth/callback?flow=recovery. Allow-list the stable /auth/callback route in hosted Auth; Core exchanges the one-use PKCE code and verifies recovery AMR before redirecting internally to /account/reset-password/new.
Reauthentication code
Subject
{{ .Token }} is your Supacharger security code
Body
<h1>Verify this security-sensitive change</h1>
<p>Enter this code in Supacharger:</p>
<p style="font-size: 32px; font-weight: 700; letter-spacing: 0.18em">{{ .Token }}</p>
<p>If you did not request this change, secure your account and contact support.</p>
Security notification pattern
For password, email, phone, sign-in-method, or verification-method changes:
- State exactly what changed.
- State the affected account address where the template safely provides it.
- Tell the user what to do if the change was unauthorized.
- Link to a stable support or account-security page, never a raw token.
Test the final versions through the production verification checklist.