-
-
Notifications
You must be signed in to change notification settings - Fork 10.8k
Description
Correction
I need to correct my initial understanding after feedback:
The Actual Behavior
These variables control the entire authentication provider, not just signup:
ENABLE_EMAIL_SIGNUP→GOTRUE_EXTERNAL_EMAIL_ENABLEDENABLE_PHONE_SIGNUP→GOTRUE_EXTERNAL_PHONE_ENABLEDDISABLE_SIGNUP→GOTRUE_DISABLE_SIGNUP(global flag)
Invite-Only Configuration
Docker:
DISABLE_SIGNUP=true
ENABLE_EMAIL_SIGNUP=true
ENABLE_PHONE_SIGNUP=trueCLI:
[auth]
enable_signup = false
[auth.email]
enable_signup = true
[auth.sms]
enable_signup = trueProposed change
Not a bug - documentation clarity issue. Fixed in #40575 and supabase/cli#4469 by adding detailed comments explaining provider vs signup control,
Original Report:
Bug report
- I confirm this is a bug with Supabase, not with my own application.
- I confirm I have searched the Docs, GitHub Discussions, and Discord.
Describe the bug
Setting [auth.email].enable_signup = false disables the entire email provider instead of just preventing signups, breaking invite-only authentication. Same issue affects [auth.sms].enable_signup.
Error: 422 {"msg":"email_provider_disabled"}
To Reproduce
CLI:
[auth.email]
enable_signup = falseDocker:
ENABLE_EMAIL_SIGNUP=falseAttempt to send a magic link or authenticate an invited user → provider disabled error.
Expected behavior
Should only disable signups while allowing invited users to authenticate via email/password/OTP.
System information
- Affects:
- Observed with: Supabase CLI latest, Docker Compose with GoTrue v2.182.1
Root cause
Config incorrectly maps enable_signup → GOTRUE_EXTERNAL_EMAIL_ENABLED (provider on/off) instead of GOTRUE_DISABLE_SIGNUP (signup permission).
Bug locations:
- CLI:
internal/start/start.golines 487, 502 - Docker:
docker/docker-compose.ymllines 132, 152
Proposed fixes: