User created by Admin always need to verify their emails even with option deactivated

[Ninjeneer]

Bug report

• [x] I confirm this is a bug with Supabase, not with my own application.
• [x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

After creating a user using admin privileges, a user always need to have their email verified, even if the option to do so is deactivated. It keeps saying "Email not confirmed" error

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Setup a brand new Supabase project
2. Authentication > Sign-In / Up > Auth Providers
3. Deactivate the need of confirmed emails
4. Create a user using Admin privilege (via Supabase dashboard for instance, or auth.admin.createUser via sdk)
5. Sign In with it, Supabase returns a "Email not confirmed" error

Expected behavior

If the option "Confirm email" is unticked, users created by Admin should be allowed to login without a verified email

System information

• OS: MacOS
• Browser Chrome
• Version of supabase-js: ^2.47.10
• Version of Node.js: 18

[haschu]

Same here!

[alexandrelipp]

Same. Any workarounds ?

[alexandrelipp]

@Ninjeneer @haschu you need to pass email_confirm: true to the admin method: await supabase.auth.admin.createUser({ email_confirm: true, ... }

[Ninjeneer]

@Ninjeneer @haschu you need to pass email_confirm: true to the admin method: await supabase.auth.admin.createUser({ email_confirm: true, ... }

No, this is not the same behavior. Doing this will auto validate the email. The scenario I am pointing here is that we should allow the login to be done without email confirmation, as per the option description says

[sonvowkm]

@Ninjeneer Try using supabase.auth.admin.createUser({ email_confirm: true, ... }). Params email_confirm doesn’t mean user has to confirm their email — it means email is already confirmed, so admin can create user without email confirmation.

[Ninjeneer]

@Ninjeneer Try using supabase.auth.admin.createUser({ email_confirm: true, ... }). Params email_confirm doesn’t mean user has to confirm their email — it means email is already confirmed, so admin can create user without email confirmation.

Once again (literally the comment above) I'm not talking about, nor using, the email_confirm: true parameter. I'm talking about the fact that a user created by the admin is not impacted by the option ticked in my screenshot and still had to validate their emails.

It's either:

1. A bug in the user flow
2. A misleading description, that should mention "this option does not apply to users created by admin" which sounds super silly tbh