Why did my Supabase login stop working?

You opened your app this morning and the login screen just sits there. Or a user emailed to say their password stopped working, and it definitely worked last week.

Start here: you almost certainly did not break it by doing something. Logins stop working for about six reasons, and four of them happen while you are asleep.

How do I work out which problem I have?

Open your app in a private browsing window and try to sign in with a fresh test account you make right now. Then open your project in the Supabase dashboard and look at it.

Those two things sort the problem immediately.

• A new account can't even be created → the project is probably asleep, or the keys are wrong.
• A new account works but one specific user can't get in → it's that account, not your app.
• Everyone gets in but the app acts like they're signed out → it's your app code, not Supabase.
• The dashboard won't let you log in → that's Supabase's own sign-in, a separate thing entirely.

Did my Supabase project get paused for inactivity?

This is the most common cause by a distance, and it feels like a disaster while being the least of one. Supabase pauses free projects that go quiet.

Their own docs say a free project counts as inactive if it doesn't get enough database activity over the past week, and that typically a few user requests to the database each day over the previous week is enough to keep it awake.¹ It is watching real traffic, not whether you had the dashboard open.

When it pauses, everything behind your app goes away at once, and that shows up first at the login screen, because signing in is the first thing that touches the database. People describe exactly this: coming back from a break, finding the app inaccessible with authentication and user errors, and only then discovering the project had been paused.²

The fix is a button. Open the project in the dashboard and choose Resume. Then go and look in the folder where those two emails probably landed.

The usual workaround is a small scheduled task that pokes the database a couple of times a week to keep it awake. That works. It's also a second thing you now have to maintain, and it fails quietly when it fails.

Could my API keys have changed underneath me?

Your app carries two bits of text that identify it to Supabase. If either stops matching, every sign-in fails instantly and identically, and nothing in your app changed.

Supabase has been moving projects off the old shared-secret arrangement for a while. The new setup adds a publishable key and a secret key alongside the old ones, and the migration guide is explicit that the old keys keep working during the transition.⁴ So the migration itself isn't what breaks people.

Regenerating is what breaks people. Supabase's troubleshooting page puts it plainly: once the secret is regenerated, all current keys are invalidated immediately and every connection using them is cut off, and you have to redeploy with the new values before anything works.⁵ If you or an AI assistant clicked something in the API settings yesterday to be safe, that's your answer.

There's a nastier version hiding where these two causes meet. In a Supabase community discussion about the new keys, the guidance includes a warning that paused projects, when restored, risk being broken because they won't have the legacy keys.⁶ So if you resumed a project and login still fails, check the keys before anything else.

Why does sign-up fail with a server error?

If new accounts fail with a server error rather than a wrong-password message, something got attached to the users table. AI builders love adding a little routine that fires when a new user signs up — create their profile row, copy their name across.

It's a reasonable thing to want, and it's the most reliable way to break account creation, because if that routine errors, the account creation errors with it.

Supabase documents this directly. Their guide to server errors during authentication points at manually created links between your own tables and the users table, at faulty migrations from outside tools, and at the account Supabase uses internally losing its permissions.⁷ Their guide to errors when creating or updating users says the same from the other end: look for anything attached to the authentication tables, which Supabase restricts access to specifically to stop changes that break the service.⁸

Read plainly: something your builder added to the sign-up flow is throwing an error. Remove it, confirm logins come back, then add it again more carefully.

New account creation is failing with a server error, but signing in with existing accounts works. Find anything we added that runs automatically when a new user signs up — profile rows, name copying, anything attached to the user table. Show me it, then remove it temporarily so account creation works again. Don't change anything else.

Why does it say "Invalid login credentials" when the password is right?

That message covers a lot of ground and tells you almost nothing, which is why it eats whole afternoons. Two checks find most of them.

From a walkthrough by Niko Fischer: trim whitespace off the email and keep capitalisation consistent between sign-up and sign-in, because a trailing space pasted from a password manager is a different email address as far as your app is concerned. And if email confirmation is switched on and the user never clicked the link, sign-in can fail with the same unhelpful message.⁹

That second one matters more than it sounds. If confirmation emails have stopped arriving, every new user looks to you like they're typing their password wrong. There's a thread in Apple's developer forums from someone whose app was repeatedly rejected because reviewers hit this message on a demo account the developer could sign into every time.¹⁰

Why does login only work after I refresh the page?

Login appears to succeed, then the app behaves as though nobody is there until you reload. That's your app not noticing the sign-in, not Supabase refusing it.

There's a long-running Supabase discussion about exactly this, and the answer given there is about how the app listens for sign-in events.¹¹ In the Supabase JavaScript library's own issue tracker, someone reports that after upgrading versions, a check for the current user started returning a session-missing error for a user who was very much logged in.¹²

That's the tell. If this started right after your builder updated packages or you accepted a dependency bump, it's the update, not your users.

What if I'm the one who can't log in?

If the failure is on Supabase's own sign-in page and the error mentions failing to fetch, that's the dashboard, not your app. There are open reports of this on Supabase's GitHub, one from March and another from April this year, including one person stuck because they couldn't open a support ticket without logging in first.¹³¹⁴

Your app may be completely fine while this is happening. Try a different browser or device before you panic.

Why didn't I find out sooner?

Look back at that list. The paused project. The keys that stopped matching. The routine that errors on sign-up. In every one, the app kept looking normal from the outside.

There was no crash and no alert. The only signal was a user who cared enough to tell you, and most people who hit a broken login just leave.

That's the specific trap with logins. It's the first thing a user touches and the last thing you check, because you're already signed in. Your own session keeps working for days after new people have stopped getting in. So the thing to fix isn't really the login — it's the gap between the moment it broke and the moment you found out.

This is what we built Fomio for. You paste a link to your app and it works out what to watch, checks it every minute, and tells you in plain English when it stops working. It reports one of three things — Working, Having trouble, or Down — and when something goes wrong it says what likely went wrong in words you already use.

The free plan watches one app from outside, checks every five minutes, emails you when it breaks, and keeps a week of history, with no card. Builder watches three apps, checks every minute, keeps thirty days, and writes a prompt you can paste straight into the tool you built with. Pro goes to fifteen apps and adds a status page your users can look at instead of emailing you. Current prices are on fomio.ai/pricing. Being told happens by email, so use an address that reaches your phone.

What should I do next?

1. 1
   Check whether the project is paused

   Open the dashboard. If it's paused, resume it — then confirm your keys still match before you assume you're done.
2. 2
   If sign-up throws a server error, clear the user table

   Find anything attached to account creation and take it out. Confirm sign-up works, then add it back carefully.
3. 3
   If it's one user only, check their email and confirmation

   Look for stray spaces or different capitalisation, and check whether their confirmation email ever arrived.
4. 4
   If it started right after an update, it's the update

   Roll the package version back and see if the behaviour goes away before you debug anything else.
5. 5
   Put something outside your app that watches it

   So the next break finds you, rather than you finding it a week later in a user's email.

And if today's answer turned out to be "it was paused", upgrade the project — or accept that a quiet week will do this again.