© 2026 Hedgehog Software, LLC

TwitterGitHubDiscord
More
CommunitiesDocsAboutTermsPrivacy
Search
Star
Setup for Free
SupabaseS
Supabase•17mo ago•
20 replies
Alan

OTP Expired or Invalid

I verify users with email OTP using supabase.auth.signInWithOtp(), then verify the code received via email with supabase.auth.signInVerifyOTP().

For some users, verifying the code always returns an error:
AuthException(message: Token has expired or is invalid, statusCode: 403, errorCode: otp_expired)

It isn't an expiration issue as I can replicate the issue within 5 seconds of receiving the code via email. The docs (https://supabase.com/docs/guides/auth/debugging/error-codes) suggest that a 403 error code is "Sent out in rare situations where a certain Auth feature is not available for the user, and you as the developer are not checking a precondition whether that API is available for the user."
I can't find any precondition that I should be checking for when verifying an OTP sent via email, and the issue only seems to occur for certain users, although I've been unable to identify criteria for it happening.
Error Codes | Supabase Docs
Supabase Auth Error Codes
Error Codes | Supabase Docs
Supabase banner
SupabaseJoin
Supabase gives you the tools, documentation, and community that makes managing databases, authentication, and backend infrastructure a lot less overwhelming.
45,816Members
Resources
Was this page helpful?

Similar Threads

Recent Announcements

Similar Threads

Token has expired or is invalid
SupabaseSSupabase / help-and-questions
5mo ago
Token has expired or is invalid
SupabaseSSupabase / help-and-questions
14mo ago
Token has expired or is invalid" error
SupabaseSSupabase / help-and-questions
2mo ago
Anyone experiencing expired OTP errors recently?
SupabaseSSupabase / help-and-questions
15mo ago