Email link is invalid or has expired
- Supabase Auth
- Magic links
What it means
The sign-in or confirmation link could not be used. Links work once and expire, and some flows only work in the browser that asked for them.
Why it happens
- The link was already used, sometimes by an email security scanner opening it first.
- It was opened in a different browser or device than the one that asked for it.
- It expired before being clicked.
- The redirect address in the link is not on your auth provider's allowed list.
How to fix it
- Ask for a new link and open it in the same browser.
- Use a token-hash or one-time-code flow if links are often opened on another device.
- Check your Site URL and allowed redirect URLs in your auth settings.
Let your AI find the cause
Paste this into Claude Code, Cursor, Lovable or whichever AI built your app. It looks first and changes nothing until you have read the answer.
Users of my app see 'Email link is invalid or has expired'. Without changing anything yet, explain how sign-in links are created and completed in this project, which flow it uses, and which redirect addresses are configured.