Send over SMTP
SMTP credentials for Supabase auth and other SMTP clients, one per region, and what mail sent over SMTP skips.
Some senders only speak SMTP: Supabase auth emails, a standby for an app's own mailer, an old CMS. For those, an organization creates SMTP credentials, and mail sent with them still lands in the email log, the timeline and webhooks. Wherever the client can make HTTP calls, prefer the API.
Create a credential
In the console, Settings, SMTP credentials, create a credential for a project and a region (admins and owners). The project needs a domain in that region first. The password is shown once; copy it into the client straight away.
| Setting | Value |
|---|---|
| Host | email-smtp. (or email-smtp.) |
| Port | 587 with STARTTLS (or 465 with TLS) |
| Username | the credential's username |
| Password | shown once when the credential is created |
| From | an address on one of the project's verified domains |
For Supabase, set these under Authentication, SMTP settings, with the sender address on your transactional domain, such as auth@mail.acme.example.
A credential sends only from the project's domains in its region, through the project's configuration sets, and follows the project's domains as they change. Deleting it stops its password at once.
A credential works in one region, so a client that should keep sending through us-west-2 during a us-east-1 outage needs a second credential for that region. Give each SMTP client its own credential, so one can be revoked without touching the others.
What SMTP mail skips
Mail sent over SMTP goes straight to SES and never passes through the platform's send pipeline:
- No suppression check before sending, no kill switch, no daily cap, no content checks, no idempotency, no templates.
- Still applied: SES's own suppression of addresses that bounced or complained (the configuration set suppresses both), sending only from the project's verified identities, and the credential's limits above.
- Still recorded: the domain's default configuration set tags every message, so its first SES event creates an email (
source: "smtp", once per message) in the credential's project and environment (production unless chosen), with the timeline, suppressions and webhooks as for API mail. An event counts only when it comes through the project's configuration set from one of the project's domains.