Configuring Resend SMTP for Supabase Password Resets

This guide walks you through configuring Supabase to use Resend's SMTP service for password reset emails.

Prerequisites

• Resend account with verified domain
• Resend API key
• Supabase project with authentication enabled

Step-by-Step Setup

1. Get Your Resend API Key

1. Log in to Resend Dashboard
2. Navigate to API Keys in the sidebar
3. Copy your existing API key, or create a new one:
   • Click Create API Key
   • Give it a name (e.g., "Supabase SMTP")
   • Copy the key immediately (you won't be able to see it again)

Note: This is the same API key you use in your RESEND_API_KEY environment variable.

2. Verify Your Sender Domain

1. In Resend Dashboard, go to Domains
2. Ensure your domain is verified (e.g., hivejournal.com)
3. Note the verified sender email address you want to use:
   • Common options: noreply@hivejournal.com, no-reply@hivejournal.com, support@hivejournal.com
   • This should match your RESEND_FROM_EMAIL environment variable

3. Configure Supabase SMTP

1. Go to your Supabase Dashboard

2. Select your project

3. Navigate to Authentication → Settings

4. Scroll down to the SMTP Settings section

5. Toggle Enable Custom SMTP to ON

6. Fill in the SMTP configuration:

   Host: smtp.resend.com
   Port: 587
   Username: resend
   Password: [Your Resend API Key]
   Sender email: noreply@hivejournal.com (or your verified email)
   Sender name: HiveJournal
   

7. Click Save

4. Configure Redirect URLs

1. Still in Authentication → Settings
2. Scroll to URL Configuration
3. Under Redirect URLs, add a wildcard per brand domain (apex AND www are separate origins):

   http://localhost:3000/**
   https://hivejournal.com/**     https://www.hivejournal.com/**
   https://graphene.fm/**         https://www.graphene.fm/**
   https://write.cafe/**          https://www.write.cafe/**
   https://lovio.io/**            https://www.lovio.io/**
   https://dreampro.io/**         https://www.dreampro.io/**
   

4. Click Save

Use the /** wildcard, not enumerated paths. Auth email links redirect to a per-flow, per-brand emailRedirectTo — email confirmation → /dashboard (or /lovio, /graphene, …), password reset → /auth/reset-password, OAuth → /auth/callback. If you allowlist only /auth/reset-password and /auth/callback, then turning on email confirmation silently breaks: the confirm link's target (https://www.lovio.io/dashboard) isn't matched, so Supabase falls back to the hivejournal.com Site URL and the user lands on the wrong host without a session on the host they signed up on. The wildcard covers every current and future emailRedirectTo path in one entry.

A branded rewrite domain missing entirely can't complete any email-link flow on its own host — see the auth-allowlist note in GOOGLE_OAUTH_SETUP.md; lovio.io shipped without these entries and every signup bounced.

5. Customize Email Template (Optional)

1. In Supabase Dashboard, go to Authentication → Email Templates
2. Select Reset Password template
3. Customize the email content if desired
4. Important: Make sure the reset link uses {{ .ConfirmationURL }}
5. Click Save

Example Template:

Subject: Reset Your HiveJournal Password

Hi there,

Click the link below to reset your password:

{{ .ConfirmationURL }}

This link will expire in 1 hour.

If you didn't request this password reset, please ignore this email.

Thanks,
The HiveJournal Team

6. Test the Configuration

1. Go to your app's forgot password page: /auth/forgot-password
2. Enter a valid email address
3. Click "Send Reset Link"
4. Check your email inbox (and spam folder)
5. You should receive an email from your Resend sender address
6. Click the link in the email
7. You should be redirected to /auth/reset-password
8. Set a new password

Troubleshooting

Email Not Arriving

1. Check Supabase Logs:

   • Go to Logs → Auth Logs in Supabase Dashboard
   • Look for SMTP errors or email sending failures

2. Verify SMTP Settings:

   • Double-check the API key is correct
   • Ensure the sender email is from a verified domain
   • Try port 465 if 587 doesn't work

3. Check Resend Dashboard:

   • Go to Emails in Resend Dashboard
   • Check if emails are being sent
   • Look for any delivery errors

4. Test SMTP Connection:

   • Supabase will test the connection when you save
   • If it fails, check the error message
   • Common issues: wrong API key, unverified domain, incorrect port

Common Errors

• "SMTP authentication failed": Check that your API key is correct
• "Sender email not verified": Verify the domain in Resend Dashboard
• "Connection timeout": Try port 465 instead of 587
• "Rate limit exceeded": Check your Resend plan limits

Verify Configuration

To verify everything is working:

1. Check Supabase Auth Logs: Look for successful email sends
2. Check Resend Dashboard: See email delivery status
3. Test with a real email: Use your own email to test the flow

Environment Variables

Make sure your backend has these environment variables set:

RESEND_API_KEY=re_xxxxxxxxxxxxx
RESEND_FROM_EMAIL=noreply@hivejournal.com

These should match the SMTP configuration in Supabase.

Security Best Practices

1. Use a dedicated API key: Create a separate Resend API key just for Supabase SMTP
2. Restrict API key permissions: If Resend supports it, limit the key to SMTP only
3. Monitor usage: Check Resend dashboard regularly for unusual activity
4. Rotate keys: Periodically rotate your API keys
5. Use verified domains: Always use emails from verified domains

Production Checklist

Before going to production:

• Domain verified in Resend
• SMTP configured in Supabase
• Redirect URLs added for production domain
• Email template customized
• Tested password reset flow end-to-end
• Monitored email delivery in Resend dashboard
• Set up email delivery monitoring/alerts

Additional Resources

• Resend SMTP Documentation
• Supabase SMTP Configuration
• Resend Dashboard
• Email Deliverability Guide - How to avoid spam folders

Troubleshooting: Emails Going to Spam

If password reset emails are ending up in spam folders, see the Email Deliverability Guide for:

• DNS record setup (SPF, DKIM, DMARC)
• Email content best practices
• Sender reputation management
• Testing and monitoring tools