EMAIL_CONFIRMATION_GUIDE.md

Email Confirmation Solutions

Problem

Supabase requires email confirmation by default, which blocks testing during development.

Solution 1: Disable in Supabase Dashboard (Recommended for Development)

Steps:

1. Go to https://supabase.com/dashboard
2. Select your project
3. Navigate to: Authentication → Providers
4. Click on Email provider
5. Find "Confirm email" toggle
6. Turn it OFF
7. Click Save

✅ Pros: Simple, no code changes needed
❌ Cons: Requires dashboard access, affects all users

---

Solution 2: Auto-Confirm Users Programmatically (Current Implementation)

The registration code already handles both scenarios:

• ✅ If email confirmation is disabled: User is auto-logged in → Redirected to master password setup
• ✅ If email confirmation is enabled: Shows helpful error message with instructions

Current Behavior:

When you register and email confirmation is enabled, you'll see:

Email confirmation is enabled. Please check your email to confirm your account, 
or disable email confirmation in Supabase Dashboard: 
Authentication → Providers → Email → Confirm email (toggle OFF)

---

Solution 3: Use Service Role Key (Advanced - For Testing Only)

⚠️ WARNING: Only use this in development! Never expose service role key in production client code.

If you want to auto-confirm emails programmatically, you would need to:

1. Create a server-side API route
2. Use the SUPABASE_SERVICE_ROLE_KEY to bypass RLS
3. Update the user's email_confirmed_at field

This is NOT recommended because it requires exposing admin credentials.

---

Recommended Approach

For Development:

Use Solution 1 - Disable email confirmation in Supabase Dashboard

For Production:

• ✅ Keep email confirmation ENABLED
• ✅ Users will receive confirmation emails
• ✅ This prevents spam and ensures valid email addresses

---

Testing the Flow

After disabling email confirmation in Supabase:

1. Register a new user:

   Email: test@example.com
   Password: Password123!
   

2. Expected Flow:

   Register → Auto Login → Master Password Setup → Vault
      ✓           ✓                ✓              ✓
   

3. What you'll see:

   • ✅ "Account created successfully! Redirecting to master password setup..."
   • ✅ Automatic redirect to /master-password?setup=true
   • ✅ Master password setup form with password visibility toggles
   • ✅ After setting master password → Redirect to /vault

---

Current Code Status

✅ Registration page (app/(auth)/register/page.tsx):

• Handles both email confirmation scenarios
• Shows clear error messages
• Auto-redirects when confirmation is disabled

✅ Login API (app/api/auth/login/route.ts):

• Checks for master password
• Redirects to setup if not set

✅ Master Password page (app/(auth)/master-password/page.tsx):

• Password visibility toggles
• Setup vs unlock modes
• Proper error handling

---

Next Steps

1. Disable email confirmation in Supabase Dashboard (Solution 1)
2. Clear browser cookies for localhost:3000
3. Register a new user (use a new email address)
4. Test the complete flow:
   • Registration → Master Password Setup → Vault Access

---

Troubleshooting

Still seeing "Please confirm your email"?

• ✅ Verify the setting was saved in Supabase
• ✅ Try with a completely new email address
• ✅ Clear browser cookies and cache
• ✅ Check Supabase logs for any errors

Can't access Supabase Dashboard?

• Contact your project admin
• Or use a test Supabase project where you have admin access

---

Ready to test! Once you disable email confirmation in Supabase, the entire flow will work seamlessly.