gitroomhq/postiz-app · warning · Error

Email with plus sign is not allowed

Error message

Email with plus sign is not allowed

What it means

Signup guard that rejects LOCAL provider registrations when the email contains a '+' and the DISALLOW_PLUS env var is set. Plus-addressing (user+tag@domain.com) can be used to create multiple accounts from one mailbox, so some deployments disable it.

Source

Thrown at apps/backend/src/services/auth/auth.service.ts:44

      process.env.DISABLE_REGISTRATION !== 'true' ||
      provider === Provider.GENERIC
    ) {
      return true;
    }

    return (await this._organizationService.getCount()) === 0;
  }

  async routeAuth(
    provider: Provider,
    body: CreateOrgUserDto | LoginUserDto,
    ip: string,
    userAgent: string,
    addToOrg?: boolean | { orgId: string; role: 'USER' | 'ADMIN'; id: string }
  ) {
    if (provider === Provider.LOCAL) {
      if (process.env.DISALLOW_PLUS && body.email.includes('+')) {
        throw new Error('Email with plus sign is not allowed');
      }
      if (body instanceof CreateOrgUserDto) {
        body.email = body.email.toLowerCase();
      }
      const user = await this._userService.getUserByEmail(body.email);
      if (body instanceof CreateOrgUserDto) {
        if (user) {
          throw new Error('Email already exists');
        }

        if (!(await this.canRegister(provider))) {
          throw new Error('Registration is disabled');
        }

        const create = await this._organizationService.createOrgAndUser(
          body,
          ip,
          userAgent

View on GitHub (pinned to 0f1647f749)

Solutions

1. Register with an email without a '+' alias
2. Unset or remove DISALLOW_PLUS from the environment if plus-addressing should be allowed
3. Strip or normalize plus-addressed emails before submitting

Example fix

# before
DISALLOW_PLUS=true

# after
DISALLOW_PLUS=

const email = 'user+tag@example.com';
if (process.env.DISALLOW_PLUS && email.includes('+')) {
  throw new Error('Choose an email without a plus alias');
}
await signup({ email });

const isPlusFreeEmail = (email: string) => !email.includes('+');

When it happens

Trigger: POSTing to /auth with provider=LOCAL while DISALLOW_PLUS is truthy and body.email includes '+'.

Common situations: Operator set DISALLOW_PLUS=true to prevent abuse; users who legitimately use Gmail-style plus addressing then cannot register.

Related errors

• Registration is disabled
• All media must be uploaded through our upload API route and
• Failed to generate auth URL
• Forbidden
• Account is already activated

AI-assisted analysis of gitroomhq/postiz-app@0f1647f749 (2026-08-27). Data as JSON: /api/errors/d05ee9d757235b09. Report an issue: GitHub.