# Supabase Auth template examples > Minimal OTP and link templates that can be audited before product branding is applied. # Supabase Auth template examples These minimal templates make the security-relevant variables and destinations easy to audit. Replace the product name, support address, and visual presentation, but preserve the selected flow. Hosted templates are edited under **Supabase → Authentication → Email Templates**. New Free plan projects must configure custom SMTP before Supabase permits template customization. ## Confirm signup with OTP Use this when `SIGN_UP_EMAIL_VERIFICATION` is `otp` and hosted Confirm Email is enabled. **Subject** ```text {{ .Token }} is your Supacharger confirmation code ``` **Body** ```html

Confirm your email address

Enter this code in Supacharger:

{{ .Token }}

This code expires according to the account security policy.

If you did not create this account, you can ignore this email.

``` Add a confirmation link only when `SIGN_UP_EMAIL_VERIFICATION` is explicitly `otp-and-link`; using either alternative consumes the same one-time verification. ## Confirm signup with a link Use this when `SIGN_UP_EMAIL_VERIFICATION` is `link`, hosted Confirm Email is enabled, and the application supplies the canonical origin as its allowed redirect. **Subject** ```text Confirm your Supacharger account ``` **Body** ```html

Confirm your email address

Use the button below to finish creating your Supacharger account.

Confirm email address

This link expires according to the account security policy and can be used once.

If you did not create this account, you can ignore this email.

``` Verify that the resulting URL contains exactly one `/auth/confirm` path. If the installed application passes a route rather than an origin as `emailRedirectTo`, preserve that contract instead of appending the route twice. ## Password recovery The Supabase-generated confirmation URL contains the recovery token and the allowed `redirectTo` destination supplied by the application. **Subject** ```text Reset your Supacharger password ``` **Body** ```html

Reset your password

We received a request to reset the password for this email address.

Choose a new password

This link can be used once. If you did not request it, you can ignore this email.

``` The request supplies `/auth/callback?flow=recovery`. Allow-list the stable `/auth/callback` route in hosted Auth; Core exchanges the one-use PKCE code and verifies recovery AMR before redirecting internally to `/account/reset-password/new`. ## Reauthentication code **Subject** ```text {{ .Token }} is your Supacharger security code ``` **Body** ```html

Verify this security-sensitive change

Enter this code in Supacharger:

{{ .Token }}

If you did not request this change, secure your account and contact support.

``` ## Security notification pattern For password, email, phone, sign-in-method, or verification-method changes: 1. State exactly what changed. 2. State the affected account address where the template safely provides it. 3. Tell the user what to do if the change was unauthorized. 4. Link to a stable support or account-security page, never a raw token. Test the final versions through the [production verification checklist](../../guides/hosted-setup/08-production-verification.md).