Adding Email to user with updateUser() always triggers Email confirmation, even when disabled.

[TheBekker]

I have a sign-up/sign-in flow with SMS OTP, and after signup the user can add their email as well.
I have disabled Email confirmation in the Email Auth Provider, but as soon as i call updateUser with the email, i receive an email to confirm this.

await supabase.auth.updateUser({ email: email });

To Reproduce

1. Setup Phone Auth provider with Twilio
2. Email Auth Provider with confirmation disabled
3. Call await supabase.auth.signInWithOtp({ phone: phone })
4. Call await supabase.auth.verifyOtp({ phone: phone, token: verificationCode, type: 'sms' }) with received auth code
5. Call await supabase.auth.updateUser({ email: email }); with your email.
6. See that you receive email about confirming your email address, even though it is set as disabled.

[iambnlvn]

@TheBekker this behavior is not fully controlled by the "Disable email confirmation" toggle under Email Auth provider settings. That setting mostly applies to sign-up/login flows — not profile updates like updateUser({ email }).

When you update a user’s email, Supabase treats it as a sensitive account change — since the email is directly tied to authentication. As a result, it always requires the new address to be verified, regardless of your email confirmation settings.

Client-Side Auth (supabase.auth):

When you use the client SDK to update the email:

await supabase.auth.updateUser({ email: 'new@example.com' });

Supabase will always send a confirmation email to the new address.
I believe this is a built-in security feature to prevent unauthorized email changes and potential account takeovers.

Even if:

The user originally signed up via phone OTP or You’ve disabled email confirmation in the dashboard settings.

The confirmation email still gets sent.
As far as I know, there’s no way to bypass this from the client side.

Admin API (supabase.auth.admin):

Meant for privileged server-side operations.
Lets you change a user’s email immediately, without requiring confirmation.

Assumes you (the backend) trust the operation and user.

So when you use the client-side SDK, you’re always going to trigger a confirmation email on email updates — no matter your Email Auth config.

TL;DR

As far as I know, Supabase sees an email update as a sensitive account change. To protect users:

It does not trust the new email unless it’s verified.
So, it always sends a confirmation email if you're using the regular client SDK (supabase.auth).

Even if you're using phone auth only, and you're simply trying to add an email later, Supabase still forces email confirmation.
There's no way to skip it on the client side.