otp_expired
what this Supabase Auth error means
How it shows up
error=access_denied&error_code=otp_expired&error_description=Email+link+is+invalid+or+has+expired
What it means
The one-time code or email link for this sign-in has expired or is not valid, so Supabase Auth refused it. The user has to sign in again to get a new one.
The usual cause in an AI-built app
Some email providers open links in incoming mail to scan them, for example Safe Links in Microsoft Defender, which uses up the link before the person clicks it. AI-built apps tend to keep the default email template, which sends a link.
Check this first
Send a new link to a personal email address and open it right away: if that works, the failing link was old, already used, or opened by a scanner first.