Common errors · Supabase Auth (Lovable, Bolt, any supabase-js v2 client)

Supabase Invalid login credentials when the password is right

Cause The app signs in against another Supabase project, or the account has no password (OAuth or magic link).
Fix Compare the project the running app uses with the one holding the user, then reset the password or offer the right sign-in method.

Have it fixed for you, 290 EURSee the fix step by step

signInWithPassword returns this single message for every failure it will not detail: wrong password, unknown email, or an account that has no password at all. Supabase keeps it vague on purpose so nobody can test which emails are registered. When the user swears the password is right, one of the cases below is almost always the reason.

Where it breaks

Which case is yours?

1. The app talks to another Supabase project than the one you look at: the production build still carries the development URL and anon key, so the user exists in one project and signs in against the other.
2. The account was created with Google, GitHub or a magic link. It has no password, so any password is wrong.
3. Test or imported users were inserted straight into auth.users with a plain text or badly hashed password. Supabase compares against a bcrypt hash and never matches.
4. The email differs by a space or a capital letter between sign up and sign in, because the form does not trim the field.

The fix, step by step

1. Print the project the running app uses and compare it with the dashboard URL of the project where the user exists.

   console.log(import.meta.env.VITE_SUPABASE_URL); // Vite, Lovable, Bolt
   // Next.js: process.env.NEXT_PUBLIC_SUPABASE_URL

2. In the SQL editor of that project, check the account exists, is confirmed, and how it signs in.

   select email, email_confirmed_at, encrypted_password is not null as has_password,
          raw_app_meta_data->>'provider' as provider
   from auth.users where lower(email) = lower('user@example.com');

3. No password or OAuth provider: send a reset email so the user sets one, or show the right sign in button for that account.

   await supabase.auth.resetPasswordForEmail(email, {
     redirectTo: "https://yourapp.com/reset-password",
   });

4. For seeded test users, create them through the admin API (server side, service role key) instead of raw SQL inserts.

   await supabaseAdmin.auth.admin.createUser({
     email: "test@example.com", password: "a-long-test-password", email_confirm: true,
   });

5. Normalise the email before both sign up and sign in.

   const email = form.email.trim().toLowerCase();

How to check it is fixed

Sign in with a fresh account created through the app on the production domain, then with an account created by OAuth after a password reset: both succeed. A wrong password still returns Invalid login credentials, which is the expected answer.