@Mail Domain Check

Supabase Auth / Brevo SMTP / provider activation

Supabase Auth with Brevo: SMTP account is not yet activated

When Supabase Auth returns 500 and the Brevo relay says the SMTP account is not yet activated, the first failed boundary is provider service activation. Preserve the exact reply, stop blind retries, and prove that boundary before changing credentials or DNS.

Generate the support brief

Browser-local escalation tool

Generate the next Brevo handoff

Select bounded states only. No address, message, token, SMTP key, API key, password or account credential is requested or transmitted.

What this error proves

Brevo's current SMTP troubleshooting guide documents 450 Your SMTP account is not yet activated for an account whose transactional platform cannot yet send. Supabase documents that an Auth 500 can originate in an external dependency such as the configured SMTP provider. Together, those two facts place the first failed boundary at Brevo account activation, not at the receiving mailbox.

If an outer layer shows 500 or 502 while the bounded provider detail contains Your SMTP account is not yet activated, retain both values. The provider text identifies the action more precisely than the outer status alone.

Do not paste a recipient, recovery URL, OTP, Supabase access token, service-role key, JWT, Brevo SMTP key, API key, password, seed phrase, private key, or wallet signature into a public issue or diagnostic.

Run one controlled Auth test

  1. Use a controlled test account and trigger one real Supabase Auth recovery, confirmation, invite, OTP, or magic-link action.
  2. Record the flow, UTC timestamp, project reference, and a random internal correlation ID. Keep the address and token private.
  3. Open Supabase Auth logs at that timestamp and preserve the bounded SMTP or gomail error.
  4. Check Brevo transactional logs for the same attempt. If the activation message appears, stop retries and treat the provider account as the owner of the next action.
  5. After activation is confirmed, retry once through the same Supabase flow and prove a successful provider handoff or message event.
  6. Only then investigate suppression, bounce, receiver acceptance, quarantine, or inbox visibility.
Turn the observed state into one owned next action.

No address, message, token, or credential is requested.

Build incident plan

The correct next action

Brevo says an unactivated transactional platform cannot send and directs the account owner to contact Brevo support by ticket. That account-level activation step cannot be fixed by changing SPF, DKIM, DMARC, the Supabase redirect URL, or the recipient mailbox.

  • Open the ticket from the affected Brevo account so support can identify the correct organization and transactional platform.
  • Provide the UTC test time, bounded relay response, sending domain, and non-secret account identifiers requested by support.
  • Do not include SMTP keys, API keys, passwords, Auth tokens, recovery links, or message content.
  • Keep retries paused until the provider confirms the platform is active; repeated failures add noise without proving a new boundary.

Verify configuration without rotating working secrets

Once the account is active, verify the documented Brevo and Supabase fields. Brevo's SMTP login is the username and an SMTP key is the password; an API key or ordinary account password is not a substitute. Supabase custom SMTP also needs the provider host, port, username, password, and default From identity.

SMTP login
Use the Brevo SMTP login shown in SMTP & API settings. Do not use the visible From address as the login unless the account explicitly shows the same value.
SMTP password
Use an active Brevo SMTP key, not a Brevo API key or dashboard password. Never expose the key in logs or screenshots.
From identity
Use a sender or domain authorized in Brevo and the same default From identity configured for Supabase Auth templates.
IP restrictions
If Brevo SMTP IP restrictions are enabled, verify that the actual Supabase sending path is allowed before attributing a later authentication failure to DNS.
Provider state
Confirm the transactional platform and SMTP key are active. A correct host and key cannot override an account-level sending restriction.

Do not collapse every failure into the same fix

Account not activated
Provider account boundary. Contact Brevo support from the affected account and pause retries.
Authentication rejected
Credential boundary. Verify SMTP login, active SMTP key, host, port, and allowed source IP without publishing the secret.
Sender rejected
Identity boundary. Verify the From address or domain inside Brevo and match the Supabase default From configuration.
Provider accepted
Follow the provider message ID through suppression, delay, bounce, or recipient-server acceptance. Acceptance is not inbox placement.
Message visible, link fails
Investigate expiration, duplicate use, redirect configuration, or security-scanner prefetch as a token-use incident, not SMTP delivery.

Decode the bounded SMTP reply locally, or use the broader Supabase Auth email boundary map when the provider message is different.

The production-ready proof

A dashboard that accepts saved settings is not end-to-end proof. Before calling the path ready, run one real Auth flow and preserve evidence that Supabase handed it to Brevo, Brevo created a message event, and the controlled receiver accepted or displayed it. Keep link completion as a separate proof.

This independent guide is not affiliated with Supabase or Brevo. Supabase Auth logs, Brevo account state and transactional events, and the receiving administrator remain the sources of truth for their respective systems.

Primary references