The send_email hook payload's email_data.site_url is populated from API_EXTERNAL_URL (e.g. https://<ref>.supabase.co/auth/v1) instead of GOTRUE_SITE_URL (e.g. https://myapp.com).
The SMTP template path gets this right — {{ .SiteURL }} resolves from GOTRUE_SITE_URL. The hook path doesn't, it pulls from API_EXTERNAL_URL instead.
So if you're using the hook to build confirmation links from site_url, they point to the auth server instead of your app. The field is called site_url but it's not the site URL.
email_data.site_url in the hook payload should use GOTRUE_SITE_URL, same as {{ .SiteURL }} in the templates.
The
send_emailhook payload'semail_data.site_urlis populated fromAPI_EXTERNAL_URL(e.g.https://<ref>.supabase.co/auth/v1) instead ofGOTRUE_SITE_URL(e.g.https://myapp.com).The SMTP template path gets this right —
{{ .SiteURL }}resolves fromGOTRUE_SITE_URL. The hook path doesn't, it pulls fromAPI_EXTERNAL_URLinstead.So if you're using the hook to build confirmation links from
site_url, they point to the auth server instead of your app. The field is calledsite_urlbut it's not the site URL.email_data.site_urlin the hook payload should useGOTRUE_SITE_URL, same as{{ .SiteURL }}in the templates.