AuthApiError: Email link is invalid or has expired

[ryuhangyeong]

# Email Template
<h2>Magic Link</h2>

<p>Follow this link to login:</p>
<p><a href="{{ .SiteURL }}/auth/confirm?token_hash={{ .TokenHash }}&type=magiclink">Log In</a></p>

import { NextResponse } from "next/server";
import { createClient } from "@/utils/supabase/server";

import type { EmailOtpType } from "@supabase/supabase-js";
import type { NextRequest } from "next/server";

export async function GET(request: NextRequest) {
  const { searchParams } = new URL(request.url);
  const token_hash = searchParams.get("token_hash");
  const type = searchParams.get("type") as EmailOtpType | null;
  const next = "/account";

  const redirectTo = request.nextUrl.clone();
  redirectTo.pathname = next;
  redirectTo.searchParams.delete("token_hash");
  redirectTo.searchParams.delete("type");

  if (token_hash && type) {
    const superBaseClient = createClient();

    const { error } = await superBaseClient.auth.verifyOtp({
      type,
      token_hash,
    });

    console.log(error);

    if (!error) {
      redirectTo.searchParams.delete("next");
      return NextResponse.redirect(redirectTo);
    }
  }

  redirectTo.pathname = "/error";
  return NextResponse.redirect(redirectTo);
}

The token is not recognized properly.

I don't know the cause.

Who can help?

[ryuhangyeong]

Self Answer

• type

magiclink -> email

[kolberszymon]

I have the same problem, what do you mean by this answer?

[ryuhangyeong]

@kolberszymon

Sorry for the late reply.

I don't know the exact reason, but

If the type is email, the flow is as follows.

If a specific email address has not yet registered, a membership registration email template will be sent.

If a specific email address is registered, it will be sent as a magic link template.

<p><a href="{{ .SiteURL }}/auth/confirm?token_hash={{ .TokenHash }}&type=email">Log In</a></p>

Try with the example above.

[Karsenh]

I'm facing similar issue and not seeing the answer here.

If an account does NOT exist in supabase and a magic link is sent, it will dispatch a "Confirmation" email.

Whereas, if the account already exists, it will dispatch a magic link email.

I've read that `supabase.auth.verityOtp({ type, token_hash}) is the logic to be run on the confirmation email callback route but I'm getting "Email link is invalid or has expired" as a result.

I realize I can simply turn off email confirmation in the project settings within supabase but I'd rather be able to handle the email confirmation to use it. How is this possible?

Thank you!

[Karsenh]

Nevermind - I just figured out that the type coming through was wrong because I set it wrong in the Confirmation email template within supabase. I was using the magic link template in the confirmation email because I didn't notice the type=magiclink vs type=signup difference.